. "The covered entity would have to disclose its collection and sharing practices, including with whom the information is shared." . . .