(a) AS 21.23.250 and 21.23.260 do not apply to

1. (1) a licensee, including an independent contractor, with fewer than 10 employees;
2. (2) a licensee if the licensee is an employee, agent, representative, or designee of another licensee covered by an information security program.

(b) AS 21.23.240 — 21.23.399 do not apply to a licensee subject to the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191) if the licensee

1. (1) has established and maintains an information security program under statutes, regulations, procedures, or guidelines established under the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191);
2. (2) is in compliance with the statutes, regulations, procedures, and guidelines established under the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191); and
3. (3) submits to the director a written statement certifying that the licensee is in compliance with the statutes, regulations, procedures, and guidelines established under the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191).