Which act governs patient health information privacy and security in the United States?

• A. HITECH Act
• B. Sarbanes-Oxley Act
• C. GLBA
• D. HIPAA

Answer: (D)

HIPAA sets the rules for protecting patient health information. It creates national standards for both privacy and security of protected health information, covering what can be disclosed, patient rights to access and correct their records, and the safeguards needed to keep PHI confidential. The Security Rule requires administrative, physical, and technical safeguards to protect electronic PHI, while the Privacy Rule limits how PHI can be used or shared and establishes the “minimum necessary” principle. Breach notification requirements are part of the regime too, ensuring patients and authorities are alerted to significant unsecured disclosures.

The HITECH Act strengthens and expands HIPAA provisions—such as increasing penalties and promoting the adoption of electronic health records—but the governing framework for privacy and security remains HIPAA. The Sarbanes-Oxley Act targets corporate financial reporting and governance, not patient health information. The Gramm-Leach-Bliley Act deals with financial privacy, not healthcare data. So HIPAA is the act that governs patient health information privacy and security.