This probably doesn't violate HIPAA. HIPAA doesn't prevent law enforcement from acquiring data in the interests of a criminal prosecution. Meanwhile, the data

This probably doesn't violate HIPAA. HIPAA doesn't prevent law enforcement from acquiring data in the interests of a criminal prosecution. Meanwhile, the data as currently silo'd is not sufficient to figure out who somebody is (ad companies are real keen on that, because they don't want the sites they serve to harvest ad data on their users and side-step the ad services; as a result, the fingerprints are usually double-blinded in a way such that only the user's browser can aggregate enough data to "know" who the user is).