Requirements that protected health information must remain within specific physical or organizational boundaries for legal compliance.