; (ii) using the primary method of communication of the genetic testing service with the customer; and (iii) in a manner that is— (I) clear and conspicuous; and (II) separate from any privacy policy, data use policy, or other similar document. (B) Inability to contact A genetic testing service may not be considered to be in violation of subparagraph (A) by reason of being unable to contact a customer, if the service sends the notification required by such subparagraph— (i) if the primary method of communication of the service with the customer is in writing, to the last known home mailing address of the customer in the records of the service; and (ii) if the primary method of communication of the service with the customer is email or other electronic means, to the last known email address, or using the last known other electronic contact information, as the case may be, of the customer in the records of the service. (3) Website notification In addition to the notifications required by paragraphs (1) and (2), a genetic testing service shall provide clear and conspicuous notification of the rights of customers under subsection (a) on the internet website of the service (if the service maintains such a website). Such notification shall be separate from any privacy policy, data use policy, or other similar document. (4) Contents The Commission shall include in the regulations promulgated under subsection (d) requirements for the contents of the notifications required by this subsection. (c) Information security requirements The Commission shall promulgate regulations that require a genetic testing service to implement policies and procedures to secure the personally identifiable information of customers of the service against unauthorized access. (d) Regulations (1) In general Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate, under section 553 of title 5, United States Code— (A) regulations to implement subsections (a) and (b)