HIPAA and suing need to be understood fully when contemplating action