All of the following information is exempt from this part:(1) Protected health information under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq.
(2) Health records.
(3) Patient identifying information for purposes of 42 U.S.C. s. 290dd-2.
(4) Identifiable private information:(a) For purposes of the federal policy for the protection of human subjects under 45 C.F.R. part 46;
(b) Collected as part of human subjects research under the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or the protection of human subjects under 21 C.F.R. parts 50 and 56; or
(c) That is personal data used or shared in research conducted in accordance with this part or other research conducted in accordance with applicable law.
(5) Information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 U.S.C. ss. 11101 et seq.
(6) Patient safety work product for purposes of the Patient Safety and Quality Improvement Act of 2005, 42 U.S.C. ss. 299b-21 et seq.
(7) Information derived from any of the health-care-related information listed in this section which is deidentified in accordance with the requirements for deidentification under the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq.
(8) Information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this section which is maintained by a covered entity or business associate as defined by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq. or by a program or a qualified service organization as defined by 42 U.S.C. s. 290dd-2.
(9) Information included in a limited data set as described by 45 C.F.R. s. 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified by 45 C.F.R. s. 164.514(e).
(10) Information used only for public health activities and purposes as described in 45 C.F.R. s. 164.512.
(11) Information collected or used only for public health activities and purposes as authorized by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. ss. 1320d et seq.
(12) The collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, or by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. ss. 1681 et seq.
(13) Personal data collected, processed, sold, or disclosed in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. ss. 2721 et seq.
(14) Personal data regulated by the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. s. 1232g.
(15) Personal data collected, processed, sold, or disclosed in compliance with the Farm Credit Act of 1971, 12 U.S.C. ss. 2001 et seq.
(16) Data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role.
(17) Data processed or maintained as the emergency contact information of an individual under this part which is used for emergency contact purposes.
(18) Data that is processed or maintained and that is necessary to retain to administer benefits for another individual which relates to an individual described in subsection (16) and which is used for the purposes of administering those benefits.
(19) Personal data collected and transmitted which is necessary for the sole purpose of sharing such personal data with a financial service provider solely to facilitate short-term, transactional payment processing for the purchase of products or services.
(20) Personal data collected, processed, sold, or disclosed in relation to price, route, or service as those terms are used in the Airline Deregulation Act, 49 U.S.C. ss. 40101 et seq., by entities subject to that act, to the extent the provisions of this act are preempted by 49 U.S.C. s. 41713.
(21) Personal data shared between a manufacturer of a tangible product and authorized third-party distributors or vendors of the product, as long as such personal data is used solely for advertising, marketing, or servicing the product that is acquired directly through such manufacturer and such authorized third-party distributors or vendors. Such personal data may not be sold or shared unless otherwise authorized under this part.
