The Health Insurance Portability and Accountability Act (1996) protects the privacy and security of health information in the United States.
Its Privacy Rule governs how Protected Health Information (PHI) can be used and disclosed, while its Security Rule sets administrative, physical, and technical safeguards for electronic PHI. It applies directly to "covered entities" (providers, insurers, clearinghouses) and to their "business associates" — vendors who handle PHI on their behalf — via signed Business Associate Agreements.
Core rules: Privacy & Security
HHS Office for Civil Rights
45 CFR Parts 160 & 164