; and (iv) ensure that data is encrypted, in accordance with the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996. (2) Applicable self-insured group health plan For purposes of paragraph (1), a self-insured group health plan is an applicable self-insured group health plan if such plan is self-administered, or is administered by a health insurance issuer or third-party administrator that meets one or both of the following criteria: (A) Administers health benefits for more than 50,000 enrollees. (B) Is one of the 5 largest administrators or issuers of self-insured group health plans in a State in which such administrator operates, as measured by the number of enrollees. (3) Issuers and third-party administrators In the case of a health insurance issuer or third-party administrator that is required under this subsection to submit claims data with respect to an applicable self-insured group health plan, such issuer or administrator shall submit claims data with respect to all self-insured group health plans that the issuer or administrator administers, including such plans that are not applicable self-insured group health plans, as described in paragraph (2). (4) Receiving other information (A) Medicare data The entity awarded the contract under subsection (a) shall maintain active certification as a qualified entity pursuant to section 1874(e) of the Social Security Act for the term of the contract awarded under subsection (a). (B) State data The entity awarded the contract under subsection (a) shall collect data from State all-payer claims databases that seek access to the database established under this section. (5) Availability of data An entity required to submit data under this subsection may not place any restrictions on the use of such data by authorized users. (e) Uses of information (1) In general The entity awarded the contract under subsection (a) shall make the database available to users who are authorized under this subsection, at cost, and