Which data privacy framework primarily governs health information protection in the United States?

• A. GDPR
• B. HIPAA
• C. PIPEDA
• D. CCPA

Answer: (B)

Focusing on the protection of health information in the United States, the framework that governs this area is HIPAA—the Health Insurance Portability and Accountability Act. It establishes standards for safeguarding individually identifiable health information, or protected health information (PHI), when it’s created, stored, transmitted, or received by covered entities such as health plans, healthcare providers, and healthcare clearinghouses, along with their business associates. The Privacy Rule sets who may access PHI and the rights patients have over their records, including access and amendment rights. The Security Rule requires appropriate safeguards for electronic PHI, while the Breach Notification Rule requires reporting of security breaches. Together, these provisions create a comprehensive approach to health data privacy and security, enforced by the HHS Office for Civil Rights. Other options relate to privacy regimes outside the U.S. health context: GDPR is European, PIPEDA is Canadian, and CCPA addresses broader consumer privacy for California residents.