of 1974 is not enacted by the date that is 2 years after the date of enactment of this Act, the Commission shall, not later than 27 months after that date of enactment, promulgate final regulations that impose such privacy requirements. (b) Contents In promulgating regulations under subsection (a), the Commission— (1) shall— (A) establish criteria for exempting certain small, newly formed covered providers from the requirements under the regulations, taking into account factors including— (i) the period of time during which the covered provider has been operating as a covered provider