Which of the following laws regulates the privacy and security of patient health information in the United States?