In this case, though not covered by HIPAA, it's also not clear there was legal consent to sell this information given it was against their privacy policy.