Which regulation governs privacy in healthcare in the United States?

• A. General data protection regulation (GDPR) applies in US healthcare.
• B. Contract law governs privacy in healthcare.
• C. HIPAA privacy and security rules.
• D. FOIA governs medical record privacy.

Answer: (C)

Privacy of health information in the United States is governed by HIPAA, specifically the Privacy Rule and the Security Rule. The Privacy Rule sets national standards for protecting PHI, defines how it can be used or disclosed, and gives individuals rights to access their records and receive a Notice of Privacy Practices. The Security Rule adds required safeguards—administrative, physical, and technical—to protect electronicPHI. Together, these rules establish how health information can be handled, who may access it, and under what circumstances it can be shared.

GDPR is European regulation and doesn’t routinely apply to U.S. healthcare operations. FOIA is about access to government records and isn’t designed to regulate patient privacy. Contract law may govern certain agreements, but it isn’t the formal regulatory framework for protecting health information in the U.S.