Tried to read the EULA and as noted by JBS the 5 words "or as permitted by law" seems to give them free reign as long as they abide by the HIPAA stuff.
Then read the federal register stuff concerning it and to loosely paraphrase it says the de-identified info can be used by other entities as long as a BAA is signed and that the information is to be used in a limited and defined scope(which is required to be stated) and safeguards and remedies are in place in case there is a data breech.
So where does that leave us since we are data generator #1 on the chain, don't know.