ACLU urges Congress to define medical privacy as patient control of electronic health records