“It does raise significant issues about whether small practices and small institutions can effectively protect patient privacy in the new age we’re living in.” ...