I don't like the data being used for marketing etc but I also don't know how to solve the issue. The doctor might need to share the data with, the company that

I don't like the data being used for marketing etc but I also don't know how to solve the issue. The doctor might need to share the data with, the company that runs their records system, Quest and or similar service companies, both of those companies probably have parts of their infrastructure run by other companies. So, the regs would have to say something like, you can share this data to any one you contract with and anyone they contract with and on and on but it can only be used for X, Y, and Z and suspect it's impossible to define XYZ both in a way that "protects your data" and in a way that lets companies provide these 3rd party services. To be more concrete. If my doctor uses MedRecords as the company that provides their patient tracking serice, and MedRecords uses AWS to store the data then I effectively have to give permission to my doctor, to MedRecords, and to Amazon. Further, the fact that I paid with a CCard means some data is send to Visa or Mastercard and to the bank the card is with so we're up to 5 companies. Some doctors have equipment that itself uses the cloud like say a modern MRI or CAT scanner. So with those companies and their providers were up to probably1 10 companies My point being, this seems like a hard problem. I wonder if there is some other solution like, make it illegal to use the data for marketing or insurance rates but otherwise it's ok to share for "legitimate business purposes" (lol)