Who said it hasn't already... isn't that kind of the standard practice of tech... "take, copy use the data" first, request data second.

When regulators discover they have a boatload of medical data, and no legal method they could have obtained it that's an instant discovery... but if they have a legal means, then they have to do a bit of detective work to prove that isn't where it came from.