shall apply to a health care clearinghouse that engages in the functions described in subsection (b)(3) to the extent that such clearinghouse has current contact information pursuant to direct interaction with the individual involved. If the clearinghouse does not have direct interaction with the individual involved, the clearinghouse shall provide notice of any breach of unsecured protected health information to the covered entity that does have direct interaction with the individual involved. The clearinghouse shall not be required to report a breach if the protected health information is rendered unusable, unreadable, or indecipherable to unauthorized persons through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2). The clearinghouse shall also provide a notice of privacy practices on its website. (f) Transition (1) In general Except where specifically stated, nothing in this section shall be construed to apply to clearinghouses to the exclusion of other covered entities or to provide a health care clearinghouse greater authority to use and disclose protected health information than that provided to another covered entity. (2) Existing agreements With respect to agreements entered into by a health care clearinghouse prior to the date of enactment of this section, a provision of such an agreement that conflicts with this section shall not have any legal force or effect. The preceding sentence may not be construed as affecting any provision of an agreement that does not conflict with this section. (g) Safe harbor and clarification of liability In the case of a health care clearinghouse that engages in a function described in subsection (b), only that clearinghouse may be held liable for a violation of a HIPAA-related provision (and a covered entity that provided data or data access to the clearinghouse shall not be liable for such violations). (h) Enforcement Section 13410(a)(2) shall apply to this section in the same manner as such section