; (3) describes the covered organization’s data retention and data security policies and practices for emergency health data; and (4) describes how an individual may exercise the rights under this Act and how to contact the Commission to file a complaint. (f) Public reporting (1) In general A covered organization that collects, uses, or discloses emergency health data of at least 100,000 individuals shall, at least once every 90 days, issue a public report— (A) stating in aggregate terms the number of individuals whose emergency health data the covered organization collected, used, or disclosed to the extent practicable; and (B) describing the categories of emergency health data collected, used, or disclosed, the purposes for which each such category of emergency health data was collected, used, or disclosed, and the categories of third parties to whom it was disclosed. (2) Rules of construction Nothing in this subsection shall be construed to require a covered organization to— (A) take an action that would convert data that is not emergency health data into emergency health data; (B) collect or maintain emergency health data that the covered organization would otherwise not maintain; or (C) maintain emergency health data longer than the covered organization would otherwise maintain such data. (g) Required data destruction (1) In general A covered organization may not use or maintain emergency health data of an individual after the later of— (A) the date that is 60 days after the termination of the public health emergency declared by the Secretary on January 31, 2020, pertaining to Coronavirus Disease 2019 (COVID–19) under section 319 of the Public Health Service Act ( 42 U.S.C. 247d ) and any renewals thereof; (B) the date that is 60 days after the termination of a public health emergency declared by a governor or chief executive of a State pertaining to Coronavirus Disease 2019 (COVID–19) in which the individual resides