; and (2) includes an online means of exercising any such right. 5. Exceptions (a) Publication of newsworthy information of legitimate public concern Nothing in this Act, or a regulation promulgated under this Act, shall apply with respect to health data or location data that is collected, retained, used, or disclosed by a covered entity for the publication of newsworthy information of legitimate public concern to the public, or to the collecting, retaining, using, or disclosing of such data by a covered entity for that purpose, if such covered entity has reasonable safeguards and processes that prevent the collecting, retaining, using, or disclosing of health data or location data for commercial purposes other than the publication of newsworthy information of legitimate public concern. (b) Public health campaigns The prohibition under section 2(a) shall not apply to any public health campaign directed toward individuals or subpopulations of individuals. (c) Disclosure pursuant to valid authorization (1) In general Nothing in this Act shall be construed to prohibit a disclosure of the health data or location data of an individual for which the individual provides valid authorization. (2) Valid authorization defined For purposes of paragraph (1), the term valid authorization has the meaning given such term in section 164.508 of title 45, Code of Federal Regulations (or a successor regulation), subject to any such adaptation the Commission shall deem necessary to apply such term to the disclosure of both health data and location data. (d) HIPAA-Compliant actions (1) In general Nothing in this Act shall be construed to prohibit any action taken with respect to the health information of an individual by a data broker that is a business associate or covered entity that is permissible under the Federal regulations concerning standards for privacy of individually identifiable health information promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 note).