How can it be legit? Your medical data/records are supposed to be COMPLETELY CONFIDENTIAL and should be released to NO ONE NOT even your mother without your express consent and authorization. This must be a investigative experiment to see how much abuse of patient confidentiality exists.
Still would need the consent and authorization from whoever the patient has given his/her POA to or his/her next of kin.