"On its face, the text of [California] section 1798.145(c)(1)(B) appears to exempt not only certain kinds of information regulated by HIPAA, but also a certain kind of organization, namely, a 'covered entity' who maintains patient information in a certain way ... In other words, the CCPA exempts an organization that 'maintains patient information in the same manner' as PHI under HIPAA. The consequence of this reading is that a health care provider might be exempt as a whole; all of its non-health care information might qualify for the CCPA's HIPAA exemption so long as the health care provider protects 'patient information' in the right way."