HIPAA also includes the right to correct incorrect information in your records. 23 may have to get unconventional to verify the individual but they're a DNA lab and have everything they need to make a positive confirmation.

HIPAA doesn't apply to 23&me.

> I assume they're under HIPAA regulations

You would be incorrect. HIPAA does not apply to 23 & Me (or, for that matter, to almost any direct-to-consumer product).

There’s no HIPAA concern if you just want to delete your info, I think.

I don't know enough about HIPAA to know if it would be a violation for them to delete my data upon your request but, assuming it is, that would be a good case for requiring identity verification.