; (B) additional personal information disclosed with such genetic information is limited to the narrowest possible scope likely to yield the intended benefit; and (C) the covered entity limits, through contractual obligations, additional types of personal information that can be processed with the disclosed genetic information and personal information. (3) a purpose specified by the Director by regulation, taking into account the potential privacy harms and potential benefits of such collection, processing, maintenance, or disclosure