; (D) includes a general description of the covered entity’s data retention practices for covered data used for a purpose described in subsection (b) and the purposes for such retention; and (E) includes a general description of the covered entity’s data security practices. (2) Reporting During the COVID–19 public health emergency, a covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall issue a public report not later than 30 days after the enactment of this Act and not less frequently than once every 60 days thereafter— (A) stating in aggregate terms the number of individuals whose covered data the entity has collected, processed, or transferred for such a purpose