I use Kaiser, recently their webpage asked nicely if I would sign a HIPAA waiver to share my data with third parties for marketing purposes. The default was Deny and they made that easy, but it was concerning.