; and (JJ) any other services set forth in an administrative services agreement or similar agreement or specified by the Secretary through rulemaking. . (4) Rule of construction Nothing in the amendments made by this section shall be construed to imply that a practice in relation to which a covered service provider is required to provide information as a result of such amendments is permissible under Federal law. (5) Effective date No contract or arrangement entered into prior to January 1, 2025, shall be subject to the requirements of subsection (b). (c) Privacy requirements Section 408(b)(2) of the Employee Retirement Income Security Act of 1974 ( 29 U.S.C. 1108(b)(2) ), as amended by section 401, is further amended by adding at the end the following: (D) Privacy requirements Covered service providers shall provide information under subparagraph (B) in a manner consistent with the privacy, security, and breach notification regulations promulgated under section 13402(a) of the Health Information Technology for Clinical Health Act ( 42 U.S.C. 17932(a) ), and consistent with the HIPAA privacy regulations (as defined in section 1180(b)(3) of the Social Security Act) and shall restrict the use and disclosure of such information according to such privacy, security, and breach notification regulations and such HIPAA privacy regulations. (E) Disclosure and redisclosure (i) Limitation to business associates A responsible plan fiduciary receiving information disclosed under subparagraph (B) may disclose such information only to the entity from which the information was received, the group health plan for which the information pertains, or to that entity’s business associates as defined in section 160.103 of title 45, Code of Federal Regulations (or successor regulations) or as permitted by the HIPAA Privacy Rule (45 CFR parts 160 and 164, subparts A and E). (ii) Clarification regarding public disclosure of information Nothing in this section shall prevent a group health plan or health insurance issuer offering group