A couple of points.

1) I agree that we should be asking questions, but so should the person making the request of you, and the person/sales person that passed the request, as should the originator of the request. There are lots of opportunities to head off an improper request. It is EVEYONE'S responsibility to question the need and the request.

2) The person with the bad lab. I feel for you. You did take the right approach, however your lawyer blew it. He should have required the lab to notify whoever they set the results to AND provide the you the names of those people. He then should have used the same 'negotiation' technique until he got to the company that reported the data to the massive insurance db that health and life insurers pay to data form. Once that data is deleted from that db, you should be able to get the life insurance people to repull the data after that. Its a pain but you need to keep on this.

Remember, in this country, you don't own the test results. The group that paid for the test own the results. NOT you. We need some laws changes but that ain't happenin' anytime soon.