A study published Monday ... outlines how expansive the market for people's health data has become. After contacting data brokers to ask what kinds of mental health information she could buy, researcher Joanne Kim reported that she ultimately found 11 companies willing to sell bundles of data that included information on what antidepressants people were taking, whether they struggled with insomnia or attention issues, and details on other medical ailments, including Alzheimer's disease or bladder-control difficulties. Some of the data was offered in an aggregate form that would have allowed a buyer to know, for instance, a rough estimate of how many people in an individual Zip code might be depressed. But other brokers offered personally identifiable data featuring names, addresses and incomes, with one data-broker sales representative pointing to lists named "Anxiety Sufferers" and "Consumers With Clinical Depression in the United States." Some even offered a sample spreadsheet. The Health Insurance Portability and Accountability Act, known as HIPAA, restricts how hospitals, doctors' offices and other "covered health entities" share Americans' health data. But the law doesn't protect the same information when it's sent anywhere else, allowing app makers and other companies to legally share or sell the data. Some of the data brokers offered ... opt-out forms. But ... many people probably didn't realize the brokers had collected their information in the first place. Privacy advocates have for years warned about the unregulated data trade, saying the information could be exploited by advertisers or misused for predatory means. The health-data issue has in some ways gotten worse, in large part because of the increasing sophistication with which companies can collect and share people's personal information " including not just in defined lists, but through regularly updated search tools and machine-learning analyses.