Experts say some hospitals’ use of an ad tracking tool may violate a federal law protecting health information