This one seems clear cut as a HIPAA violation. Glad to hear that interpretation was upheld.

However, regardless, we really need to just kill the data broker business model.

Speaking as someone who implemented GDPR for my startup when the law first came into effect, there were certainly rough edges.

But the core premise that you simply cannot sell user data to sub-processors without consent is a powerful one that I believe would fix a lot of broken things in the US system.

(Not least because the USG buys private data that would be unconstitutional for it to directly collect, but also things like the incentives for your cell phone provider to sell your location data to advertisers.)