The Health Insurance Portability and Accountability Act of 1996, particularly the Privacy Rule under Title II, regulates the use and disclosure of Protected Health Information (PHI) held by covered entities and business associates. HIPAA is the base operational privacy rule on which the Orange County HMIS privacy rule is structured.