associates A group health plan receiving a report under paragraph (1) may disclose such information only to the entity from which the report was received or to that entity’s business associates as defined in section 160.103 of title 45, Code of Federal Regulations (or successor regulations) or as permitted by the HIPAA Privacy Rule (45 CFR parts 160 and 164, subparts A and E). (B) Clarification regarding public disclosure of information Nothing in this section shall prevent a group health plan or health insurance issuer offering group health insurance coverage, or an entity providing pharmacy benefits management services on behalf of such a plan or coverage, from placing reasonable restrictions on the public disclosure of the information contained in a report described in paragraph (1), except that such plan, issuer, or entity may not restrict disclosure of such report to the Department of Health and Human Services, the Department of Labor, the Department of the Treasury, or the Comptroller General of the United States. (C) Limited form of report The Secretary shall define through rulemaking a limited form of the report under paragraph (1) required with respect to group health plans where the plan sponsors of such plans are drug manufacturers, drug wholesalers, or other direct participants in the drug supply chain, in order to prevent anti-competitive behavior. (5) Report to GAO A group health plan or health insurance issuer offering group health insurance coverage, or an entity providing pharmacy benefits management services on behalf of such plan or coverage, shall submit to the Comptroller General of the United States each of the first 4 reports submitted to a group health plan under paragraph (1) and other such reports as requested, in accordance with the privacy requirements under paragraph (3), the disclosure and redisclosure standards under paragraph (4), the standards specified pursuant to paragraph (6), and such other information that the Comptroller General determines necessary to carry out the study