Medical marijuana user sues health insurer for violating HIPAA privacy rules