IANA medical professional, but my understanding is that the Health Insurance Portability and Accountability Act (HIPAA), which purports to protect patient privacy, actually *permits* the sale of patient records to certain medical-related businesses. Hospitals have fought efforts to stop the practice because they can make a lot of money selling their databases.

Individual states may restrict such sales, but it sounds as if Maine may not be one of them...