; or (bb) an organization not organized to carry on business for its own profit or that of its members. (B) Exclusions The term covered entity does not include an entity that is— (i) a covered entity, as defined in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation), to the extent such entity is acting as a covered entity under the HIPAA privacy regulations (as defined in section 1180(b)(3) of the Social Security Act ( 42 U.S.C. 1320d–9(b)(3) )); (ii) an entity that is a business associate, as defined in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation), to the extent such entity is acting as a business associate under the HIPAA privacy regulations (as defined in such section 1180(b)(3)); or (iii) an entity that is subject to restrictions on disclosure of records under section 543 of the Public Health Service Act ( 42 U.S.C. 290dd–2 ), to the extent such entity is acting in a capacity subject to such restrictions. (5) Data broker The term data broker means an individual or entity that— (A) collects, buys, licenses, or infers data about an individual