Which U.S. federal law specifically governs the privacy of health information and requires healthcare organizations to implement safeguards for patient data?