; (2) the number of individuals affected; and (3) actions taken in response to such breaches. 5. Excluded entities Nothing in this Act, or the regulations promulgated under this Act, shall apply to— (1) covered entities to the extent that such entities act as covered entities or business associates (as such terms are defined in section 13400 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17921 )) that are subject to section 13402 of such Act ( 42 U.S.C. 17932 ); and (2) covered entities to the extent that they act as vendors of personal health records (as such term is defined in section 13400 of such Act ( 42 U.S.C. 17921 )) and third-party service providers that are subject to section 13407 of such Act ( 42 U.S.C. 17937 ). 6. Definitions In this Act: (1) Appropriate Federal agency The term appropriate Federal agency means— (A) the Commission; (B) the Federal Bureau of Investigation