We don't put the patient's name on the EKG, so it's not directly identifiable, and we get their consent before submitting (if they're in any state to consent, which often they aren't), but I'm sure it does violate all kinds of rules and guidelines, if not actual laws.