Doesn't sound like he was doing anything illegal but I think the people who were using his service wasn't very smart. All he does is make MMJ cards that got there authorization from a doctor. He does not need all the medical info, It sounds like both the police and this guy should be sued.
This is why there should not be any state registry for MMJ patients and the only one that has your medical records is your doctor.