Does HIPAA allow a researcher to do a bunch of assays on patient blood samples without their knowledge or consent? I don't know, but I doubt that a patient consenting to a blood draw for creatinine, platelets, and bilirubin gives a lab a blank check to do a bunch of other tests.