The issue is that virtually all practices will refuse to disclose any medical information to third parties without explicit written authorization.

I'm certain a lot of this behavior is illegal, but people who don't know or choose to ignore the law are everywhere, and litigation is expensive and time-consuming. I just want to build stuff, so I take these sorts of policies as a warning sign and look elsewhere.