; (2) the privacy and security of any data submitted to such entity under subsection (d) of such section; and (3) the costs incurred by such entity in performing duties under such a contract. (b) Reports Not later than two years after the effective date of the first contract awarded under section 1(b), and again not later than four years after such effective date, the Comptroller General of the United States shall submit to Congress a report containing the results of the study conducted under subsection (a), together with recommendations for such legislation and administrative action as the Comptroller General determines appropriate.