Glenn, I was in nursing and on our practice council when the HIPAA privacy regulations rolled out.
We went over those regs with a fine tooth comb. Unless that waiver is very carefully worded and extensive these people are not following the law.
After looking at the regs our attorney at the time said that the consent to release information type forms had to include the purpose the information was released for, and who the information was released to with "some specificity". Blanket releases wouldn't work.
Maybe he was wrong, or the law has evolved but I'll bet you dollars to doughnut's that their consent said nothing about their records being released to LE for the purpose of determining whether they could have any sort of permit.
Gaily bedight, A gallant knight In sunshine and in shadow, Had journeyed long, Singing a song, In search of El Dorado