“Uses direct language of theft and breach to highlight the urgent risk to patient privacy and safety.”