Information about a person’s past, present, or potential health condition that is gathered from them by a covered entity must be protected because it either identifies the person or there is a good reason to think that it can be used to find, identify, or get in touch with them.