Which federal law primarily governs the privacy and security of patient health information in a US aesthetic nursing practice?