The regulatory framework establishes the relevant jurisdiction for matters related to custody and storage of personal health data