Connecticut case finds health care privacy cause of action