1. (1) Data subject to a statute or regulation identified under item (i) of this item that is controlled by a covered entity or service provider that is:

   1. (i) Required to comply with:

      1. 1. Title V of the federal Gramm-Leach-Bliley Act;
      2. 2. The federal Health Information Technology for Economic and Clinical Health Act; or
      3. 3. Regulations promulgated under § 264(c) of the Health Insurance Portability and Accountability Act of 1996; and
   2. (ii) In compliance with the information security requirements of applicable statutes or regulations identified in item (i) of this item; or

2. (2) Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, in accordance with:

   1. (i) Good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or
   2. (ii) Human subject protection requirements of the U.S. Food and Drug Administration.

This subtitle does not apply to:

Added by Acts 2024, c. 460, § 1, eff. Oct. 1, 2024; Acts 2024, c. 461, § 1, eff. Oct. 1, 2024.