; and (E) total gross spending on all drugs during the reporting period. (3) Privacy requirements (A) In general Entities providing pharmacy benefits management services on behalf of a group health plan shall provide information under paragraph (1) in a manner consistent with the privacy, security, and breach notification regulations promulgated under section 13402(a) of the Health Information Technology for Clinical Health Act and consistent with the HIPAA privacy regulations (as defined in section 1180(b)(3) of the Social Security Act) and shall restrict the use and disclosure of such information according to such privacy, security, and breach notification regulations and such HIPAA privacy regulations. (B) Additional requirements (i) In general An entity providing pharmacy benefits management services on behalf of a group health plan that submits a report under paragraph (1) shall ensure that such report contains only summary health information, as defined in section 164.504(a) of title 45, Code of Federal Regulations (or successor regulations). (ii) Restrictions A group health plan shall comply with section 164.504(f) of title 45, Code of Federal Regulations (or a successor regulation) and a plan sponsor shall act in accordance with the terms of the agreement described in such section. (C) Rule of construction Nothing in this section shall be construed to modify the requirements for the creation, receipt, maintenance, or transmission of protected health information under the HIPAA privacy regulations (as defined in section 1180(b)(3) of the Social Security Act). (4) Disclosure and redisclosure (A) Limitation to business associates A group health plan receiving a report under paragraph (1) may disclose such information only to the entity from which the report was received or to that entity’s business associates as defined in section 160.103 of title 45, Code of Federal Regulations (or successor regulations) or as permitted by the HIPAA Privacy Rule (45 CFR parts 160 and 164, subparts A and E). (B)