HIPAA wasn’t meant to handle a pandemic