How is this legal I thought medical records were private. anyone able to give a explanation as to how a company can harvest medical records. I cant see how this can even be legal.