Patient privacy rights explained simply