https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg...
You have to explicitly grant permission for your data to be sold. What's very likely is that either the healthcare provider or insurance company included a request for authorization to sell that data, and the authorization was signed without paying much attention to it.