identifying which pieces of information from a patient’s medical records are considered protected health information (PHI) under HIPAA