; (3) adopt reasonable safeguards to prevent unlawful discrimination on the basis of emergency health data; and (4) only disclose such data to a government entity when the disclosure— (A) is to a public health authority; and (B) is made in solely for good faith public health purposes and in direct response to exigent circumstances. (b) Right to security A covered organization or service provider that collects, uses, or discloses emergency health data shall establish and implement reasonable data security policies, practices, and procedures to protect the security and confidentiality of emergency health data. (c) Prohibited uses A covered organization shall not collect, use, or disclose emergency health data for any purpose not authorized under this section, including— (1) commercial advertising, recommendation for e-commerce, or the training of machine-learning algorithms related to, or subsequently for use in, commercial advertising and e-commerce; (2) soliciting, offering, selling, leasing, licensing, renting, advertising, marketing, or otherwise commercially contracting for employment, finance, credit, insurance, housing, or education opportunities in a manner that discriminates or otherwise makes opportunities unavailable on the basis of emergency health data; and (3) segregating, discriminating in, or otherwise making unavailable the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation (as such term is defined in section 301 of the Americans With Disabilities Act of 1990 ( 42 U.S.C. 12181 )), except as authorized by a State or Federal Government entity for a public health purpose notwithstanding subsection (g). (d) Consent (1) In general It shall be unlawful for a covered organization to collect, use, or disclose emergency health data, unless— (A) the individual to whom the data pertains has given affirmative express consent to such collection, use, or disclosure