Regulation would explain what you can and cant do. No different then Hipaa