HHS Secretary Mike Leavitt announced “new” principles and tools to protect consumers’ personal health records. Here’s the link to the HHS press release.
The guidance clearly is based on the principles of the HIPAA Privacy and Security Rules. It is intended to reach beyond HIPAA covered entities

and their business associates to PHR vendors such as Microsoft Healthvault and Dossia that operate outside those rules.