By now, multiple sources have sounded the alarm that your 23andMe genetic data might be at risk. All point out the tremendous privacy risks associated with such data being released. And all ask whether those harms might come to pass if 23andMe goes bankrupt, since 23andMe is not bound by HIPAA. But none makes a serious attempt at answering the question.

One reason for this is because the answer is that it is impossible to know for sure. Your data is at risk, but the extent to which it is at risk is unclear. But there are facts, law and precedent on point, which are worth examining.