Which law governs confidentiality of patient information in the U.S. healthcare setting?

• A. FERPA.
• B. ADA.
• C. SOX.
• D. HIPAA.

Answer: (D)

HIPAA sets the standards for protecting patient health information in the United States. It creates national privacy and security rules that define how PHI (protected health information) can be used, disclosed, and stored, giving patients rights over their records and outlining when disclosures are allowed without patient consent. The Privacy Rule covers the basic protections for information shared in treatment, payment, and healthcare operations, while the Security Rule focuses on safeguarding electronic PHI and the Breach Notification Rule requires reporting if a breach occurs. HIPAA applies to covered entities like doctors, hospitals, and health plans, and to their business associates.

The other laws don’t govern health information confidentiality in the same way. FERPA protects student education records, not general patient health data. ADA deals with disability rights and access, not patient privacy. SOX concerns corporate financial reporting and internal controls, not medical privacy.