A small practice can hold enough client data to fuel hundreds of identity theft cases. Here’s how firm leaders can close the gaps attackers count on.