. "However, a particular challenge remains in protecting such information when it is held by hospitals, insurers, individual physician's offices, employers, or other institutions." . . . .