Sec. 132. Constraints on distribution of information
269 words·~1 min read·
/bill/115/s/2187/is/section-132A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Each covered entity shall— require by contract that any third party to which it transfers covered information use the information only for purposes that are consistent with— the provisions of this title; and as specified in the contract; require by contract that such third party may not combine information that the covered entity has transferred to it, that relates to an individual, and that is not personally identifiable information with other information in order to identify such individual, unless the covered entity has obtained the opt-in consent of such individual for such combination and identification; and before executing a contract with a third party— assure through due diligence that the third party is a legitimate organization; and in the case of a material violation of the contract, at a minimum notify the Commission of such violation.
A covered entity may not transfer covered information to a third party that the covered entity knows— has intentionally or willfully violated a contract required by subsection (a); and is reasonably likely to violate such contract. Except as provided in paragraph (2), a third party that receives covered information from a covered entity shall be subject to the provisions of this Act as if it were a covered entity. The Commission may, as it determines appropriate, exempt classes of third parties from liability under any provision of subtitle B if the Commission finds that— such class of third parties cannot reasonably comply with such provision; or with respect to covered information relating to individuals that is transferred to such class, compliance by such class with such provision would not sufficiently benefit such individuals.