Under HIPAA, any scrap of "individually identifiable health information" that can be used to connect online data with a patient cannot be sent to a third party without consent.