and in compliance with, the information security requirements of section 13401 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 ) or of section 1173(d) of title XI, part C of the Social Security Act ( 42 U.S.C. 1320d–2(d) ) shall be deemed in compliance with this section with respect to any data governed by section 13401 of the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 ) or by the Health Insurance Portability and Accountability Act of 1996 Security Rule (45 C.F.R. 160.103 and part 164). 3. Notification of breach of security (a) Nationwide notification A covered entity that owns or possesses data in electronic form containing personal information, following the discovery of a breach of security of the system maintained by the covered entity that contains such data, shall notify— (1) each individual who is a citizen or resident of the United States and whose personal information was or is reasonably believed to have been acquired or accessed from the covered entity as a result of the breach of security