Yes, they are. One can use credit card data to track the status of a patient. You shouldn't leak this vital information to anyone.