Is GeneTree’s Counseling Portal HIPAA-Compliant for Pedigree Chart Patient Exports?

Overview of HIPAA Compliance Requirements

What HIPAA covers—and what it doesn’t

HIPAA applies to covered entities (health plans, most health care providers, and clearinghouses) and their business associates. It protects “Protected Health Information” (PHI)—identifiable health data created or received by these entities. Consumer genealogy sites are generally outside HIPAA unless they contract as a business associate. If no covered-entity or BAA relationship exists, HIPAA typically does not govern the site’s handling of user-submitted family history. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/who-must-comply-with-hipaa-privacy-standards/index.html?utm_source=openai))

For you to treat a pedigree chart as HIPAA-regulated, it must contain identifiable health details tied to care or operations of a covered entity or business associate. Otherwise, privacy rules may fall under contracts and state laws, not HIPAA. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/protected-health-information/index.html?utm_source=openai))

What makes a pedigree export HIPAA-compliant

• Confirm roles: you (or your organization) must be a covered entity or business associate, with a signed BAA covering any vendor that stores or transmits PHI. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/business-associates/index.html?utm_source=openai))
• Apply the minimum necessary standard and prefer de-identification when feasible (for example, use age or year rather than exact dates). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html?utm_source=openai))
• Honor health information portability: on request, provide individuals access to their records in the requested form and format when readily producible. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html?utm_source=openai))
• Follow robust Patient Data Export Protocols: authenticate users, log access, encrypt files in transit and at rest, and document disclosures. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?utm_source=openai))

No official HIPAA certification

There is no government “HIPAA certification.” HHS does not endorse private certifications; compliance is demonstrated through ongoing risk analysis, safeguards, and documentation. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/are-we-required-to-certify-our-organizations-compliance-with-the-standards/index.html?utm_source=openai))

History of GeneTree Counseling Portal

Origins and shutdown timeline

GeneTree launched in 1997, later operating under the Sorenson Molecular Genealogy Foundation. In 2012, Ancestry.com acquired SMGF-related DNA assets linked to GeneTree, and GeneTree shut down on January 1, 2013. ([en.wikipedia.org](https://en.wikipedia.org/wiki/GeneTree))

What “counseling” meant at GeneTree

Public materials from the era describe GeneTree as a consumer family-history and DNA service that also offered consultation to help customers interpret results. However, documentation of a distinct, HIPAA-oriented “Counseling Portal” with clinical pedigree export controls is not evident in the public record. ([en.wikipedia.org](https://en.wikipedia.org/wiki/GeneTree))

Analysis of Pedigree Chart Exports

When a pedigree is PHI

A pedigree chart becomes PHI when it includes identifiable health information created or received by a covered entity or its business associate. In journals and standards, pedigrees are recognized as privacy-sensitive; guidance emphasizes minimizing identifiers (for example, using birth year instead of full dates) to align with HIPAA principles. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/protected-health-information/index.html?utm_source=openai))

Export scenarios you should evaluate

• Clinical export to another HIPAA-regulated system: ensure minimum necessary data, secure transmission, audit trails, and role-based access. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?utm_source=openai))
• Export to a consumer genealogy platform: unless a BAA exists, the platform is typically not HIPAA-regulated; exporting identifiable clinical pedigrees there can conflict with HIPAA obligations. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/who-must-comply-with-hipaa-privacy-standards/index.html?utm_source=openai))
• De-identified or limited-data-set sharing: prefer removal of direct identifiers and follow documented Patient Data Export Protocols. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html?utm_source=openai))

Data Privacy and Security Measures

Technical safeguards that matter

Use contemporary Data Encryption Standards (for example, strong encryption at rest and TLS in transit), granular access controls, and continuous logging with Compliance Auditing. These align with the HIPAA Security Rule’s expectations for reasonable and appropriate safeguards. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?utm_source=openai))

Administrative and process controls

Maintain risk assessments, workforce training, sanctions, incident response, and vendor BAAs. Build Genetic Data Privacy into your standard operating procedures, including retention, disposal, and breach notification workflows. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?utm_source=openai))

Transfer of Assets and Implications

Ancestry Data Transfer in 2012

In 2012, Ancestry.com obtained access to SMGF-related DNA assets and GeneTree’s assets, after which GeneTree services wound down. Data stewardship shifted into Ancestry’s consumer ecosystem. ([en.wikipedia.org](https://en.wikipedia.org/wiki/GeneTree))

What that means for HIPAA

Because HIPAA regulates covered entities and business associates—not general consumer websites—data moved to a consumer ancestry environment is typically governed by consumer privacy policies and contracts rather than HIPAA, absent a BAA. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/who-must-comply-with-hipaa-privacy-standards/index.html?utm_source=openai))

Current Status of GeneTree Services

As of September 22, 2026, GeneTree remains closed; customer access ended January 1, 2013. There is no active GeneTree counseling or pedigree export portal for clinical use today. ([en.wikipedia.org](https://en.wikipedia.org/wiki/GeneTree))

Alternatives for HIPAA-Compliant Tools

Modern pedigree and family-history solutions to consider

• PhenoTips: clinical pedigree maker with documentation and enterprise features; vendor materials state HIPAA compliance and EHR integration options. Verify a signed BAA and your configuration before use. ([phenotips.com](https://phenotips.com/?utm_source=openai))
• Progeny Clinical: long-standing clinical genetics database and pedigree tool; vendor materials describe HIPAA-supporting security and integration. Execute a BAA and review export controls. ([progenygenetics.com](https://progenygenetics.com/clinical/?utm_source=openai))
• FamGenix (clinical offering): vendor materials state HIPAA/GDPR-aligned hosting with encryption; confirm BAA terms and role-based access in your environment. ([famgenix.com](https://famgenix.com/data/?utm_source=openai))

Selection checklist for compliance

• Business Associate Agreement executed before any PHI flows.
• Encryption in transit and at rest, fine-grained permissions, and audit logs.
• Configurable Patient Data Export Protocols (format, de-identification options, watermarking, and revocation).
• Documented risk analysis, workforce training, and Compliance Auditing cadence.

Conclusion

Because GeneTree shut down in 2013, there is no current GeneTree Counseling Portal to support HIPAA-compliant pedigree exports. If you handle clinical pedigrees as PHI, choose active, healthcare-focused tools that provide BAAs, robust encryption, and auditable export controls—and implement strict minimum-necessary and de-identification practices to protect patient privacy. ([en.wikipedia.org](https://en.wikipedia.org/wiki/GeneTree))

FAQs.

Was GeneTree’s Counseling Portal operational after 2013?

No. GeneTree closed on January 1, 2013, and no counseling or pedigree export portal from GeneTree has been active since. ([en.wikipedia.org](https://en.wikipedia.org/wiki/GeneTree))

Does HIPAA apply to family history websites?

Not by default. HIPAA covers health plans, most providers, clearinghouses, and their business associates. Consumer family-history sites are outside HIPAA unless they sign a BAA to handle PHI on behalf of a covered entity. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/who-must-comply-with-hipaa-privacy-standards/index.html?utm_source=openai))

Are pedigree charts considered protected health information?

Yes—when a pedigree contains identifiable health information created or received by a covered entity or business associate. Best practice is to limit identifiers (for example, years instead of exact dates) and share the minimum necessary. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/protected-health-information/index.html?utm_source=openai))

What are the alternatives for HIPAA-compliant pedigree chart exports?

Look to purpose-built clinical tools whose vendors state HIPAA-supporting controls and who will sign BAAs, such as PhenoTips, Progeny Clinical, and FamGenix. Always validate encryption, access controls, audit logging, and export options in your own environment. ([phenotips.com](https://phenotips.com/?utm_source=openai))