The reality is, had the privacy notice been available appropriately, and had been signed, how do you know that it is enforced? Most practices are busy and run rather chaotically to think about that. By and large most medical groups do not want to share information about their patients with people who don't need it. We don't have marketers walking into our offices asking for specific patient information. We only share it with appropriate individuals, that have been authorized by the patient or who are clearly involved in the patients care for a particular condition.

I suppose there are databases out there with diagnoses of patients and the medications they take, but there are no patient identifiers in these databases, so it's basically an anonymous batch. That kind of anonymous data is going to be important to make further advances in healthcare IT, and healthcare in general.