; (8) comply with an individual’s request for confirmation, access, correction, or deletion under this subsection even if the request is received from another covered entity, if the receiving covered entity can verify that the request is originally from the individual; and (9) comply with an individual’s request for confirmation, access, correction, or deletion under this subsection not later than 90 days after receiving a verifiable request from the individual or another covered entity. (b) Right of parents and guardians of minors For purposes of subsection (a), a parent or guardian of a minor may act on behalf of the minor with respect to personal information of the minor held by a covered entity, including by requesting confirmation of, access to, correction of, or deletion of the personal information. (c) Prohibition on de-Identifying personal information subsequent To request A covered entity may not de-identify an individual’s personal information during the 90-day period beginning on the date on which the covered entity receives a request from the individual for confirmation, access, correction, or deletion of the individual’s personal information under subsection (a). 7. Prohibition on re-identifying personal information (a) In general In promulgating regulations under section 3, the Commission shall require a covered entity to ensure that personal information that has been de-identified is not restored such that the information can be linked to a specific individual or device. (b) Actions required In carrying out subsection (a), the Commission shall— (1) require a covered entity to implement— (A) technical safeguards that prohibit identification of the individual to whom or device to which the information may pertain; (B) processes that specifically prohibit reidentification of the information; and (C) processes that prevent inadvertent release of de-identified information