Which federal law most directly governs privacy protections for patient health information transmitted during telepractice sessions?