Sets out the requirements for the protection of personal information held in health care information systems from breaches of integrity and confidentiality. It applies to all forms of health information, whether held in computerised systems or hard copy records, in both private and public sector organizations.