§300jj–19. Miscellaneous provisions — Inbound Citations

(iii) is conducted in accordance with the requirements of HIPAA privacy and security law (as defined in section 300jj–19 of this title);

(d) The data collection and analysis under this section shall be conducted and maintained in a manner that protects the confidentiality of individually identifiable health information consistent with applicable statutes and regulations, including, as applicable, HIPAA privacy and security law (as defined in section 300jj–19(a)(2) of this title) and section 552a of title 5.