The correct answer is HIPAA.

The HIPAA law enacted in 1996 established national standards for protecting the privacy and security of individually identifiable health information. It introduced the Privacy Rule and the Security Rule and required covered entities and their business associates to implement administrative, physical, and technical safeguards and to follow breach notification procedures.

The HIPAA requirements specifically apply to health plans, health care clearinghouses, and health care providers that transmit health information electronically and they are the primary United States law for protecting patient health information.

General Data Protection Regulation is not correct because it is a European Union regulation that was adopted in 2016 and became enforceable in 2018 and it does not represent the United States law passed in 1996.

Sarbanes Oxley Act is not correct because that 2002 law addresses corporate financial reporting and auditor independence and it does not set rules for protecting patient health information.

Gramm Leach Bliley Act is not correct because that 1999 law governs the handling of consumers financial information by financial institutions and it does not establish the privacy and security rules for medical records.

Full AWS Practitioner Certification Question