In the privacy and security area, this law contains new reporting requirements and penalties for breaches of protected health information (PHI).