regardless, how is this any different than any other website handing over information when a lawful request has been made? is there some expectation that exchanges are immune from these sorts of requests from law enforcement agencies?
similarly, is there any question that correspondence with a public agency can potentially be entered into a public record? this doesn't actually overturn doctor patient confidentiality (which would be worthy of a scary headline), it's just enumerating the same problems you likely already need to contend with when dealing with private insurance.