I might be wrong, but I don't think a genetic sequencer is something that's easy to build in your garage without anyone knowing. So if loose hair is not PHI but the information that the owner of that hair has or not a genetic disorder is PHI, we could say that the PHI starts once the genome of a human is sequenced from a tissue sample. So, yes, anyone who has a genetic sequencer must have the same level of security as a doctor's office. That doesn't seem like a terrible requirement.