; (2) capturing longitudinal data pertaining to the initiation and ongoing prescription or dispensing of antiretroviral therapy for individuals diagnosed with HIV (such as through pharmacy-based reporting); (3) obtaining information— (A) on a voluntary basis, on sexual orientation and gender identity; and (B) on sources of coverage (or the lack thereof) for medical treatment (including coverage through Medicaid, Medicare, the program under title XXVI of the Public Health Service Act ( 42 U.S.C. 300ff–11 et seq.; commonly referred to as the Ryan White HIV/AIDS Program ), other public funding, private insurance, and health maintenance organizations); and (4) obtaining and using current geographic markers of residence (such as current address, zip code, partial zip code, and census block). (b) Privacy and security safeguards In carrying out this section, the Secretary of Health and Human Services shall ensure that appropriate privacy and security safeguards are met to prevent unauthorized disclosure of protected health information and compliance with the HIPAA privacy and security law (as defined in section 3009 of the Public Health Service Act ( 42 U.S.C. 300jj–19 )) and other relevant laws and regulations. (c) Prohibition against improper use of data No grant under this section may be used to allow or facilitate the collection or use of surveillance or clinical data or records— (1) for punitive measures of any kind, civil or criminal, against the subject of such data or records