The HIPAA privacy rule:
A) limits how personal health information can be used.
B) requires security of health records in paper, electronic, or other forms.
C) eliminates the need for patient consent.
D) A and B.