; or (B) another court of competent jurisdiction. (2) Service of process In an action brought under subsection (a), process may be served in any district in which the defendant— (A) is an inhabitant; or (B) may be found. 10. Effect on State law The provisions of this Act shall supersede any provision of the law of any State, or a political subdivision thereof, relating to notification by a business entity engaged in interstate commerce of a security breach, except as provided in section 5(5). 11. Reporting on security breaches (a) Report required on national security and law enforcement exemptions Not later than 18 months after the date of enactment of this Act, and annually thereafter, the Director of the United States Secret Service and the Director of the Federal Bureau of Investigation shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate on a report on the number and nature of security breaches subject to the national security and law enforcement exemptions under section 3(a). (b) Report required on safe harbor exemptions Not later than 18 months after the date of enactment of this Act, and annually thereafter, the Commission shall submit to the Committee on Energy and Commerce of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report on the number and nature of the security breaches described in the notices filed by business entities invoking the risk assessment exemption under section 3(b) and the response of the Commission to such notices. 12. Excluded business entities Nothing in this Act, or the regulations promulgated under this Act, shall apply to— (1) business entities to the extent that such entities act as covered entities or business associates (as such terms are defined in section 13400 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17921 )) subject to section 13402 of such Act ( 42 U.S.C. 17932 )