; and (ii) authorized users, including employers, employee organizations, providers, researchers, and policymakers, subject to subsection (e). (2) Privacy and security The entity receiving a contract under subsection (a) shall— (A) be subject to the breach notification rule under subpart D of part 164 of title 45, Code of Federal Regulations (or any successor regulations), the security rule under part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or any successor regulations), and the privacy rule under part 160 and subparts A and E of part 164 of title 45, Code of Federal Regulations (or any successor regulations); and (B) consistent with the requirements and prohibitions in the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996— (i) ensure that the database under subsection (a) is capable of— (I) receiving data under subsection (d); (II) providing data access to authorized users; and (III) storing data on secure servers in a manner that is consistent with the privacy, security, and breach notification requirements under section 13402 of the HITECH Act and under the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996; (ii) not disclose to the public any individually identifiable health information or proprietary financial information; (iii) strictly limit staff access to the data to staff with appropriate training, clearance, and background checks and require regular privacy and security training; (iv) maintain effective security standards for transferring data or making data available to authorized users; (v) develop a process for providing access to data to authorized users, in a secure manner that maintains privacy and confidentiality of data; (vi) adhere to current best security practices with respect to the management and use of such data for health services research, in accordance with applicable Federal privacy law