"Where disclosures are required by Arizona state statutes, the Privacy Rule's minimum necessary standard does not apply, because the law requiring the disclosure will establish the limits on what should be disclosed."