Which law addresses data protection requirements for health care institutions?

• A. GLBA
• B. HIPAA
• C. Sarbanes-Oxley
• D. The SEC Act

Answer: (B)

HIPAA addresses data protection requirements for health care institutions. It establishes national standards for safeguarding patient health information, covering how PHI can be used or disclosed and mandating safeguards for electronic PHI, along with breach notification if data is compromised. It applies to covered entities like health plans and providers and to business associates who handle PHI, enabling secure data exchange while protecting patient privacy.

The other laws focus on different domains: GLBA protects consumer financial information held by financial institutions; Sarbanes-Oxley targets corporate governance and financial reporting for public companies; the Securities Exchange Act deals with securities regulation. So, for health care data protection, HIPAA is the relevant framework.