In the United States, health privacy is governed primarily by two federal laws. In 1996 Congress enacted the Health Insurance Portability and Accountability Act, or HIPAA. Under HIPAA, the Department of Health and Human Services, or HHS, created the Privacy Rule, which is intended to protect patients’ private information while also improving health-record management. The Privacy Rule applies only to certain entities, called covered entities. Most healthcare entities,...