Security regulations which are laws

Question:
Which of the following regulations is NOT a US federal law?

1. HIPAA
2. GLBA
3. PCI DSS

Answer:
C - is the correct answer. The PCI DSS is a set of standards created by credit card companies