HIPAA at 5: Privacy act reaches beyond hospitals