Also, doesn't them having your medical records subject them to laws like HIPAA? I would think so even if they aren't a medical institution.