Yes! It's like with all the other "available" data.

Down the road nobody gives much about "where it came from", which is understandable in regards to risk-cost-minimization for instance of other health insured people, right?

Things can become pretty tricky once the cat is out of the bag, or better pii data is freely available in the wild, which is why I believe only with fair, but draconian individual damage compensation this will get the recognition needed to slowly reduce the number of data, privacy breaches.

Cheers!
Lucky