How does the law protect patient rights in managed care?