; and (B) subject to the jurisdiction of an agency or authority described in section 505(a) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6805(a) ). (2) HIPAA and hitech regulated entities An entity that is subject to and in compliance with the data security requirements of the following, with respect to data that is subject to such requirements: (A) Section 13401 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 ). (B) Part 160 or 164 of title 45, Code of Federal Regulations (or any successor regulations). (C) The regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 note). (D) In the case of a business associate, as defined in section 13400 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17921 ), the applicable privacy and data security requirements of part 1 of subtitle D of title XIII of division A of the American Reinvestment and Recovery Act of 2009 ( 42 U.S.C. 17931 et seq.). (3) Service providers A service provider for any electronic communication by a third party, to the extent that the service provider is engaged solely in the transmission, routing, or temporary, intermediate, or transient storage of that communication. 202. Requirements for consumer privacy and data security program (a) Consumer privacy and data security program A covered entity subject to this subtitle shall comply with the following safeguards and any other administrative, technical, or physical safeguards identified by the Federal Trade Commission in a rulemaking process pursuant to section 553 of title 5, United States Code, for the protection of sensitive personally identifiable information: (1) Scope A covered entity shall implement a comprehensive consumer privacy and data security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity, and the nature and scope, of the activities of the covered entity. (2) Design The