https://www.pewtrusts.org/en/research-and-analysis/blogs/sta...

There is an example. There has been a proliferation of for-profit companies offering health-related services which aren't counted as healthcare providers which a freely selling and distributing personal data for profit, to law enforcement, and accidentally because they are "not medicine" but in reality they are indeed collecting data about your health and giving you tools, information, and advice as a result of that data.

Companies covered by HIPAA are also sharing your health data extensively either through authorizations which don't very well describe the sharing which is actually happening, or freely without notification or approval as "deidentified" data which has been shown time and again to be rather trivial to unmask deidentified records to figure out the person in question.