; (B) a user name or email address in combination with a password or security question and answer that would permit access to an online account; (C) biometric information of an individual; (D) the content of a wire communication, oral communication, or electronic communication, as those terms are defined in section 2510 of title 18, United States Code, to which the individual is a party, unless the covered entity is the intended recipient of the communication; (E) information that relates to— (i) the past, present, or future diagnosed physical or mental health or condition of an individual; (ii) the provision of health care to an individual; or (iii) the past, present, or future payment for the provision of health care to an individual; (F) a financial account number, debit card number, credit card number, if combined with an access code, password, or credentials that provide access to such an account; (G) the race or ethnicity of the individual; (H) the religious beliefs or affiliation of the individual; (I) the sexual orientation of the individual; (J) the precise geolocation of an individual that is technically derived and that is capable of determining with reasonable specificity the past or present actual physical location of the individual more precisely than a zip code, street, or town or city level; or (K) such other specific categories of personal data as the Commission may define by rule issued in accordance with section 553 of title 5, United States Code, the collection or processing of which could lead to reasonably foreseeable harm to an individual. (15) Service provider The term service provider means an entity that collects or processes personal data on behalf of, and at the direction of, a covered entity to which the service provider is unaffiliated, but only— (A) with respect to the personal data collected or processed on the behalf of, and at the direction of, such covered entity