But existing federal health privacy guidance shows that PBMs can disclose patients' protected health information to the ...