; (B) the HIPAA regulations; or (C) Federal or State medical records retention and health privacy laws or regulations, or other applicable Federal or State laws. (h) Emergency data collected, used, or disclosed before enactment (1) Initiating a rulemaking Not later than 7 days after the date of enactment of this Act, the Commission shall initiate a public rulemaking to promulgate regulations to ensure a covered organization that has collected, used, or disclosed emergency health data before the date of enactment of this Act is in compliance with this Act, to the degree practicable. (2) Completing a rulemaking The Commission shall complete the rulemaking within 45 days after the date of enactment of this Act. (i) Non-Application to manual contact tracing and case investigation Nothing in this Act shall be construed to limit or prohibit a public health authority from administering programs or activities to identify individuals who have contracted, or may have been exposed to, COVID–19 through interviews, outreach, case investigation, and other recognized investigatory measures by a public health authority or their designated agent by a public health authority or their designated agent intended to monitor and mitigate the transmission of a disease or disorder. (j) Research and development This section shall not be construed to prohibit— (1) public health or scientific research associated with the COVID–19 public health emergency by— (A) a public health authority; (B) a nonprofit organization, as described in section 501(c)(3) of the Internal Revenue Code of 1986; or (C) an institution of higher education, as such term is defined in section 101 of the Higher Education Act of 1965 ( 20 U.S.C. 1001 )