Protecting health information privacy in research: how much law do Australians need?