Sergei meets with his insurance agent Nikita to purchase a $50,000 critical illness policy. Nikita explains that to apply for the policy Sergei would have to answer a series of personal questions about his finances, health, and lifestyle. Sergei is uncomfortable giving Nikita such detailed personal information. Nikita reassures Sergei by telling him that the insurer must follow stringent rules about how they can collect and handle this information. Which organization legislates privacy statutes pertaining to insurance companies?