---
title: "Map a US privacy file to the statutes that actually apply"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-privacy-law-gap-table-against-the-principles-that-apply/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R1-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-09-23"
---

# Map a US privacy file to the statutes that actually apply

> From the client’s data map, list possible triggers: HIPAA PHI, GLBA financial information, CCPA consumer personal information, Colorado ADMT, Rule 1.6 client information.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-privacy-law-gap-table-against-the-principles-that-apply/united-states  
Last reviewed: 2026-09-23

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the client’s data map, list possible triggers: HIPAA PHI, GLBA financial information, CCPA consumer personal information, Colorado ADMT, Rule 1.6 client information. |
| What the lawyer must review | Name the statute that applies; there is no general federal privacy law Open the California AG CCPA page and the HHS HIPAA page Open Colorado SB26-189 if consequential decisions are in scope |
| Written for | United States |
| Applies to | [Build a privacy-law gap table against the principles that apply](https://ailawframework.com/practice/privacy-data-protection-and-cyber/build-a-privacy-law-gap-table-against-the-principles-that-apply.md) |

## Checking plan

- What the AI does: From the client’s data map, list possible triggers: HIPAA PHI, GLBA financial information, CCPA consumer personal information, Colorado ADMT, Rule 1.6 client information.
- Basis: Checked against the linked sources on 23 September 2026. Confirm the current instrument before reliance.

## Sources

- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-09-23)
- [HHS: HIPAA covered entities and business associates](https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html) (checked 2026-09-23)
- [Colorado Senate Bill 26-189 (became law 14 May 2026)](https://leg.colorado.gov/bills/sb26-189) (checked 2026-09-23)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-09-23)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-09-23)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*