; or (B) mandate, direct, or condition the award of any Federal grant, contract, or purchase, on compliance with such recognized security practices. (3) No liability for nonparticipation Nothing in this section shall be construed to subject an entity or business associate to liability for electing not to engage in the recognized security practices defined by this section. (4) Rule of construction Nothing in this section shall be construed to limit the Secretary’s authority to enforce the HIPAA Security rule (part 160 of title 45, Code of Federal Regulations, and subparts A and C of part 164 of such title), or to supersede or conflict with an entity or business associate’s obligations under the HIPAA Security rule. . 503. GAO study on the privacy and security risks of electronic transmission of individually identifiable health information to and from entities not covered by the Health Insurance Portability and Accountability Act (a) In general Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall conduct a study to— (1) describe the roles of Federal agencies and the private sector with respect to protecting the privacy and security of individually identifiable health information transmitted electronically to and from entities not covered by the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 note); (2) identify recent developments regarding the use of application programming interfaces to access individually identifiable health information, and implications for the privacy and security of such information