I think I should start by saying that I'm certainly not an expert in the field of mandatory reporting and the logistics of it. In general, the current mandatory reporting is typically in a scenario of trying to prevent harm. A concern that an individual is going to cause harm to someone is the most classic scenario in which we would be obliged to breach confidentiality. In this instance, the distinguishing feature is that the harm has already been done. I think it's a bit different knowing that someone is about to embark on the act of transplant tourism as opposed to knowing that somebody has already done that act.
That would be the primary distinction I would come up with at this point.