The rules dramatically change the way hospitals, doctors, health plans and pharmacies must handle personal health information. They also impose criminal and civil penalties for breaching patient privacy.