I'd venture that it's implied that b) pertains to entities that would have legal access to or possession of the file in the course of medical related business. The "acquire" part could cover insurance companies, record storage facilities, IT companies, medical transcription companies, CSRs, etc.With the standard caveat that IANAL, it looks pretty cut and dry that ESPN is in violation there. How could you possibly parse that so that ESPN is a) not a "commercial entity" and b) did not "acquire, maintain, store or use" JPP's medical records?