yeah that's what I'm curious about. For example if we went to Electronic Medical Records i'm not sure the companies could just dig stats from that. But I guess what's alarming in the case of 23andMe is that they've taken the tactic of ignoring FDA. If a company goes rogue and takes "corp vs. the gov" attitude they are probably gearing up to push some limits that their consumers may not be prepared for and which may not technically be legal "yet" (while they try to lobby to change laws).
If they don't think FDA rules apply to them, why would they think HIPAA rules do?
HIPAA and FDA are completely independent. HIPAA is much broader and at the same time much less cumbersome to comply with. I'd be extremely surprised if they weren't being HIPAA compliant, not just because of the law but because HIPAA doesn't ask much that they wouldn't be insane not to do anyway.