an individual’s health insurance application and claims history. (F) Information about an individual’s geographic location generated by or derived from the operation or use of an electronic communications device that is sufficient to identify the street and name of the city or town in which the device is located, excluding telephone numbers or network or internet protocol addresses. (G) Password-protected digital photographs and digital videos not otherwise available to the public. (12) Service provider The term service provider means a business entity that provides electronic data transmission, routing, intermediate and transient storage, or connections to its system or network, where the business entity providing such services does not select or modify the content of the electronic data, is not the sender or the intended recipient of the data, and the business entity transmits, routes, or provides connections for sensitive personally identifiable information in a manner that sensitive personally identifiable information is undifferentiated from other types of data that such business entity transmits, routes, or provides connections. Any such business entity shall be treated as a service provider under this Act only to the extent that it is engaged in the provision of such transmission, routing, intermediate and transient storage or connections. I Punishment for concealment of security breaches and tools to combat cybercrime 101. Concealment of security breaches involving sensitive personally identifiable information (a) In general Chapter 47 of title 18, United States Code, is amended by adding at the end the following: 1041. Concealment of security breaches involving sensitive personally identifiable information (a) In general Whoever, having knowledge of a security breach and of the fact that notice of such security breach is required under title II of the Consumer Privacy Protection Act of 2017 , intentionally and willfully conceals the fact of such security breach, shall, in the event that such security