For this specifically, shouldn't HIPAA apply and quite strictly at that?
Unlike the general Internet where laws are so poor that an opt-out hidden checkbox is sufficient as "consent", HIPAA is quite specific on what is needed and who needs to get it.
Unlike the general Internet where laws are so poor that an opt-out hidden checkbox is sufficient as "consent", HIPAA is quite specific on what is needed and who needs to get it.