"The harms involved in loss or theft of medical records involve not just worries about medical identity theft but also feelings of personal violation and fears of potential misuse or publication of sensitive medical information."