The act is HIPAA. No hippos were harmed in the making of this law.
What's covered by HIPAA is often exaggerated. To hear some tell it, saying "gesundheit" when someone sneezes is a violation. That said, if Apple does start storing or transmitting personal health data, they would very much be bound by HIPAA. In fact, protecting the privacy of electronic medical data records is the purpose of the law.