You should have a Business Agreement with them that requires them to keep confidential all information they may get from you.
It probably has something about only using the information for appropriate patient care.
Thus, if they were going through your data to figure out which lab you used the most, that would be outside of the scope of patient care and should be a violation.
I need to review the business agreements I have signed in the past. I usually do not pay a great deal of attention to them, other than to skim them for agregious variations in terms.
