All of those things are illegal FYI. Medical and criminal records are entirely different things.

I wonder how it changes the calculus when medical data is leaked into the public domain then hoovered-up by data brokers.

Is a law being broken by a data broker if a credible case can be made that the data was publicly available?

I would think the leaking party would be subject to action, but does the "taint" of the data being private somehow get "washed away" if it becomes publicly available? Asked another way, is a party who consumes illegally-leaked but publicly available data also on the hook for privacy regulations.

For now. With all that is happening in the US I wouldn't be surprised if medical records will become public for law enforcement and immigration.

I'm here in Europe on a private health plan, my blood results go straight to my insurance company. Wouldn't be surprised if my premiums got adjusted if my cholesterol goes up.

It's only illegal until someone in power decides it isn't. Anyone watching the US over the past year should know that by now. (And anyone who has lived under a repressive regime or a country that has slid into autocracy or fascism already knows this well.)