Are current federal privacy laws sufficient for protecting individuals' health information?