records required by paragraph (1) shall include the following: (A) A unique identifier for the employee or contractor accessing personal information or contents of communications. (B) The date and time of access. (C) The fields of information accessed. (D) The individuals whose personal information was accessed or the contents of whose communications were accessed. (3) Small businesses excluded This subsection does not apply to a small business. 203. Prohibitions on disclosing of personal information (a) Consent for disclosing required (1) In general A covered entity may not intentionally disclose personal information unless the covered entity obtains consent of the individual whose personal information is being disclosed for each category of third party to which such personal information will be disclosed. Such covered entity must also provide such individual with notice of— (A) each category of third party