HIPAA. General info here: http://www.hhs.gov/ocr/privacy/index.html
My responses to questions on Avvo are never intended as legal advice and must not be relied upon as legal advice. I give legal advice only in the course of an attorney-client relationship. Exchange of information through Avvo's Questions forum does not establish an attorney-client relationship with me. That relationship is established only by individual consultation and execution of a written agreement for legal services.
While I agree that HIPAA does provide some protections of certain medical records, you should be aware that these protections are somewhat limited based upon who has access to the records, and that violations of HIPAA do not themselves provide a private right of action as a remedy, although such violations may act as evidence to bring state-law based causes of action. Consult a privacy attorney in Oregon, as state laws vary widely in this regard.