Which federal regulation establishes the legal requirement for maintaining the confidentiality and security of patient health information in the United States?