The hospital is only legally forbidden from sharing the patient's medical records without the patient's consent. The patient legally granted permission for the hospital to release medical information to CNN and the hospital has continued to refuse to do so.
