Under the federal medical privacy law, known as HIPAA, protected information includes demographic data that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual, which may include names, addresses and other information that was contained in the documents taken from the clinic.