Law bans marketing, not sales?
I haven't taken the time to look at the original legislation but as quoted in your report, it doesn't say they can't sell, just that they can't hang onto information for marketing.
I also wonder about this ambiguity:
"knowingly collect or receive health-related information or personal information for marketing purposes"
I can read that statement as:
a) "(collect or receive health-related information) OR (collect or receive personal information for marketing purposes)"
b) "(collect or receive health-related information or personal information) for marketing purposes"
b) is solely about using information for marketing.
a) is more serious as it stops them receiving health-related information for purposes such as advising on what drugs to buy, or not. That seems to lock out advisory services as well as sales.
I'm not a lawyer, just a programmer who spends his life looking for subtle ambiguities in code...