@Aceticon @technology In the US it is called HIPAA.

Among other things the a law directs ensuring and protecting the privacy of an individual’s “PII”, or Personally Identifiable Information, which includes but is not limited to health and medical information. Basically, any person or entity that “touches” PII is required to be certified by the National Institute of Health. Training is online. Depending on your role,the training might be customized. For example, I am certified for scientific studies involving human subjects. Only people and entities that receive any Federal funding are required to follow HIPAA. The penalty for even one violation may include loss of Federal funding *forever* so those with health-related research take it especially seriously. NIH has a hotline to report violations and they DO investigate.