Which federal law primarily governs the privacy and security of patient health information in the United States?