to generate such codes or passwords, in combination with either of the following data elements: (I) An individual’s first and last name or first initial and last name. (II) A unique account identifier (including a financial account number or credit or debit card number), electronic identification number, user name, or routing code. (viii) Information generated or derived from the operation or use of an electronic communications device that is sufficient to identify the street name and name of the city or town in which the device is located. (ix) Any information regarding an individual’s medical history, mental or physical condition, medical treatment or diagnosis by a health care professional, or the provision of health care to the individual, including health information provided to a website or mobile application. (x) A health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual or any information in an individual’s health insurance application and claims history, including any appeals records. (xi) Digitized or other electronic signature. (xii) Nonpublic communication such as a text, SMS, MMS, RCS, and other electronic message or other user-created content such as an email, photograph, or video. (xiii) Any record or information concerning payroll, income, financial account, mortgage, loan, line of credit, utility bill, accumulated purchase, or any other information regarding a financial asset, obligation, or spending habit. (xiv) Any additional element the Commission defines as personal information in accordance with subparagraph (B). (B) Modified definition by rulemaking The Commission may, by rule promulgated under section 553 of title 5, United States Code, modify the definition of personal information under subparagraph (A). (7) Small business concern The term small business concern has the meaning given that term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (8) State The term State means each of the several