The Health Insurance Portability and Accountability Act of 1996 that requires protection of health information; HITECH Act 2009 expanded HIPAA to include notification requirement.