I dunno, they offer blood tests ordered by a clinician. That probably creates a covered entity.. then the hackers get the phi data, they for sure do not have a business associates agreement with 23andme. May only matter for the blood draws.