Sure, but they didn't give data to a credit agency. That would require consent, and even if you assume they ignored HIPAA, if they'd done it for one daughter th

Sure, but they didn't give data to a credit agency. That would require consent, and even if you assume they ignored HIPAA, if they'd done it for one daughter they'd have done it for both.