> it's not illegal to sell private data

In this case, though not covered by HIPAA, it's also not clear there was legal consent to sell this information given it was against their privacy policy.