Huh, had no idea, thanks for bringing that up. Obvious follow-up question: Say the insurance company is using a third-party that they buy some kind of individual "healthiness/sickness benchmark" from, that just so happens to be heavily derived from on this genetic information, which the health insurer never sees in raw - would that fall under this? Seems like an easy way to skirt this regulation, but i am obv NAL.