Do more to protect health-care privacy