You can sue the person who stole the information, if you can identify him or her. You can sue anyone who misuses your personal information, if that happens and you can identify the person. But you can't sue the doctor. Liability is based on fault; and the doctor is not a fault when someone robs him or her, and is not responsible for another person's criminal acts.