Wouldn't reporting anyone to CBI be a violation of federal medical privacy laws?