California's extension of its data breach notification law to cover health care records promises to have significant impact on how medical organizations deal with patient information