Schools and hospitals in the US are selling data about the students and patients they are supposed to serve.