I'm not real sure. But I think that because it is because of something medically related, (i.e. they are verifying your reason for not being able to be in the sun) they can look into it. Now if they were just doing it to nose into your business then it would be in violation of the privacy...