“The letter of the law from CMS is that if you don’t go through this full validation process, you cannot release the results with patient identifying information.”