"The lowest level category could include information such as blood type and allergies, while a high-level category could include the patient's HIV status." . . . . .