Institutions worth emphasizing, therefore, that the such as hospitals and social agencies are subject to confidentiality primary source of statutory direction for security of PHI is in the obligations contained in the Public Hospitals Act, the Long-Term privacy Care Act, 1994, and other similar laws. legislation.