Certified Ethical Hacker (CEH) Practice Question

In the United States, protected health information (PHI) is regulated primarily by the Health Insurance Portability and Accountability Act (HIPAA). HIPAA's Privacy and Security Rules mandate safeguards for the confidentiality, integrity, and availability of electronic PHI and impose significant civil and criminal penalties for improper use or disclosure. The Sarbanes-Oxley Act focuses on corporate financial reporting, COPPA covers data collected online from children under 13, and FISMA applies to information systems used by U.S. federal agencies. Therefore, HIPAA is the regulation that directly applies to the handling of patient medical records obtained during a penetration test for a healthcare organization.