Which compliance framework applies to safeguarding a patient prescription list?

PCI DSS governs the protection of payment card cardholder data and applies to entities that process card transactions, not patient health or prescription records.

SOX (Sarbanes-Oxley Act) applies to financial reporting accuracy and internal controls for publicly traded companies, not to patient health information.

HIPAA (Health Insurance Portability and Accountability Act) establishes the Privacy and Security Rules that govern how covered entities must protect Protected Health Information (PHI). Patient prescription lists are explicitly classified as PHI, making HIPAA the directly applicable compliance framework for safeguarding them.

COBIT is an IT governance and management framework providing best practices for enterprise IT management, not a regulatory compliance standard for protecting health data.