If physical DNA were PHI, then everywhere we deposit DNA would need to have the same security as your doctor's office.

But the data revealed in analyzing the DNA (e.g. if you have a genetic disorder) should be PHI.

It's odd how something could go from "not PHI" to "now this is PHI" just by processing something like a piece of hair.

"At what point does it turn into PHI" would be a difficult question to answer.

IMO protection of DNA related data deserves something different than HIPAA.