In the US, regulations such as HIPAA provide guidelines but very little in terms of specific controls or actions needed. Frameworks like the HITRUST CSF can help, as they are much more prescriptive and harmonize globally recognized standards including HIPAA, HITECH, NIST, ISO, PCI DSS, FTC, COBIT and State laws.