You might wonder why IT usually has to deal with regulations rather than with laws or statutes. Answer: Federal and state lawmakers delegate their legislative power to administrative agencies--like the Department of Labor--just as CIOs and managers pass tasks down through their chains of command.
Regulations or rules promulgated by these agencies have the same legal effect as laws or statutes. But unlike statutes, rules do not need to go through the legislative process to have the force of law. The public, however, does have an opportunity to participate in the rulemaking process. Agencies are required to publish a notice of their proposed rulemaking in the Federal Register and to give the public a chance to comment. An agency responds to the comments and publishes a final rule.
The Federal Register is published daily on a regular business schedule. All issues in a given year are collected into a single volume with consecutive pagination throughout the year. After rules and regulations are published in the Federal Register, they are brought together by subject matter in the CFR (Code of Federal Regulations). The CFR comprises 50 titles, ranging from agriculture to wildlife and fisheries. For GLBA and HIPAA, the CFR includes all the regulations in force for banks (Title 12) and public welfare (Title 45).
Resources
Code of Federal Regulations (CFR)
Cornell Legal Information Institute
Federal Register (FR)
FindLaw
Thomas, Legislative Information on the Internet
US Code (USC)