Payers setting own rules for sharing health information