In the United States the privacy and security requirements for personal health information (PHI) are set forth in the Health Insurance Portability and Accountability Act (HIPAA) and its accompanying regulations, as governed by the Department of Health and Human Services (DHHS).