; (ii) preventing risks to the health or safety of a child or young adults or groups of children or young adults; or (iii) repairing errors that impair existing functionality. (4) Limitation on disclosing covered information to third parties (A) Disclosures Such regulations shall prohibit a covered entity from disclosing covered information to a third party unless the covered entity has a written agreement with such third party that— (i) specifies all of the purposes for which the third party may process the covered information for which the covered entity has verifiable consent; (ii) prohibits the third party from processing covered information for any purpose other than the purposes specified under clause (i); and (iii) requires the third party to provide at least the same privacy and security protections as the covered entity; or (B) Responsibilities of covered entities regarding third parties Such regulations shall require a covered entity— (i) to perform reasonable due diligence in selecting any third party to enter into an agreement under subparagraph (A) and to exercise reasonable oversight over all such third parties to assure compliance with the requirements of this Act; and (ii) if the covered entity has actual or constructive knowledge that a third party has violated the agreement described in subparagraph (A) to— (I) to the extent practicable, promptly take steps to ensure compliance with such agreement