; and (D) the entity transferring the information agrees to take reasonable steps to stop and remediate unauthorized processing of information by the entity to whom such information is transferred. (3) Limitation None of the exceptions under paragraphs (1) and (2) shall supersede any contrary rule promulgated by the Federal Trade Commission that is in effect on the date of enactment of this Act. (c) Treatment of consumer health information as protected health information If a covered entity or business associate, acting in its capacity as a business associate, receives consumer health information generated by a personal consumer device at any time for any reason, such consumer health information is considered protected health information and is subject to the same protections and restrictions under parts 162 and 164 of title 45, Code of Federal Regulations (or any successor regulations), as any other protected health information. 4. Enforcement The Secretary of Health and Human Services shall enforce the requirements of section 3 against an entity that collects or receives consumer health information in the same manner and to the same extent, as such secretary enforces the privacy regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( Public Law 104–191 ; 110 Stat. 2033) against a covered entity.