“According to the Privacy Rights Center, up to 10 million Americans are victims of ID theft each year. They have a right to be notified when their most sensitive health data is stolen.”