[Ensign Steve]

IANAL or even remotely knowledgeable on the topic, but I'm going to spout off anyway because it's more fun than doing actual work.

You know those rewards cards you can get from the Walgreens, or even the grocery store slash pharmacy, that track your purchase data, that they definitely sell? Is there some kind of clause in the TOS of those that we have agreed to that says they can sell our prescription medicine activity?

I would really like to hope that they can't just bury a "you waive your HIPAA rights" thing in the middle of the thing they know you're not going to read before you hit OK, but I would really like to hope lots of things that aren't so.