[ethbr1]

That's one reason (among many) the preexisting condition part of ACA is so important.

Without it, health insurance companies would have every incentive to do what car insurance companies do -- buy profiles and records from third parties and use those to adjust rates and willingness to insure.

E.g. the obvious step of buying genetic information from 23andme, because it isn't covered by HIPAA

[nradov]

GINA prohibits health insurance companies from using genetics to deny coverage or set premiums.

https://www.hhs.gov/hipaa/for-professionals/special-topics/g...

[ethbr1]

I'd feel a lot better with customer-centric privacy protections around the collector and storer, a la HIPAA.

Instead of regulating only some of the uses.

HHS already had to administratively extend to cover gaps (we'll see how that goes, post-Chevron) and Congress attempted to repeal it for workplace purposes in 2017.

And there's still the gray market question about 23andme -> Equifax-alike packaging it into a blended proprietary risk score -> insurance companies using that (of course 'without knowing that genetic information was included').