Technologic advancements and the evolving digital health landscape have offered innovative solutions to several of our health care system's issues as well as increased the number of digital interactions and type of personal health information that is generated and collected, both within and outside of traditional health care. This American College of Physicians' position paper discusses the state of privacy legislation and regulations, highlights existing gaps in health information privacy protections, and outlines policy principles and recommendations for the development of health information privacy and security protections that are comprehensive, transparent, understandable, adaptable, and enforceable. The principles and recommendations aim to improve on the privacy framework in which physicians have practiced for decades and expand similar privacy guardrails to entities not currently governed by privacy laws and regulations. The expanded privacy framework should protect personal health information from unauthorized, discriminatory, deceptive, or harmful uses and align with the principles of medical ethics, respect individual rights, and support the culture of trust necessary to maintain and improve care delivery.