I looked at the site and I see why this is tough. A somewhat different approach could be to have to person enter an email address adn email the results. Then you block certain domains ie the insurance company, from getting email. Not perfect but perhaps less intrusive thatn other methods

Athoer option is the courts, state an offical policy on the use of the data and get a judge to make a ruling about thier misuse of the info.