; and (5) employ security and authentication standards, as the Secretary determines appropriate. (d) Denial or discontinuance of access A group health plan or health insurance issuer offering group or individual health insurance coverage may deny access or discontinue access of the application programming interfaces (or successor technology or standards) to third-party applications or services on the basis of reasonable privacy or security concerns, as determined by the Secretary, including at the request of the enrollee. (e) Notification When obtaining enrollee authorization to share information with a third party under this section, a group health plan or a health insurance issuer offering group or individual health insurance coverage shall include a notification for the enrollee that information shared with a third party that is not a covered entity or business associate is not subject to the privacy, security, or breach notification rules under parts 160 and 164 of title 45, Code of Federal Regulations (or successor regulations). (f) Rule of construction regarding privacy Nothing in this section shall be construed to alter existing obligations of a covered entity or business associate under the privacy, security, and breach notification rules promulgated under section 264(c) of the Health Insurance Portability and Accountability Act or section 13402 of the HITECH Act, or to alter the Secretary’s existing authority to modify such rules, under part 2 of title 42, Code of Federal Regulations (or successor regulations), under section 444 of the General Education Provisions Act ( 20 U.S.C. 1232g ) (commonly referred to as the Family Educational Rights and Privacy Act of 1974 ), under the amendments made by the Genetic Information Nondiscrimination Act, or under State privacy law. . (b) Effective date Section 2715B of the Public Health Service Act, as added by subsection (a), shall take effect 18 months after the date of enactment of this Act. 9. Required exceptions process for medication step therapy protocols (a)