The rules around orb-patient confidentiality are vague at best.