What's preventing a health insurance company from buying 23andMe and doing what they want with the data? (i.e., reducing costs by denying coverage...)
If it were legal and they did want to do it then why would they need to buy 23andMe to accomplish this? Instead they'd just refuse to insure you without you providing a sample of your DNA.