; or (2) as is strictly necessary to provide a product or service that the individual to whom such data relates has requested from such covered entity. (c) Minimization of employee access A covered entity shall restrict access to health data by any employee or service provider of the covered entity to only such an employee or service provider for which access is necessary to provide a product or service that the individual to whom such data relates has requested from the covered entity. (d) Privacy policy (1) Policy required A covered entity shall maintain a privacy policy relating to the practices of such covered entity regarding the collecting, retaining, using, and disclosing of health data. (2) Publication required If a covered entity has a website, such covered entity shall prominently publish the privacy policy described in paragraph (1) on such website. (3) Contents The privacy policy described in paragraph (1) shall be clear and conspicuous and contain, at a minimum, the following: (A) A description of the practices of the covered entity regarding the collecting, retaining, using, and disclosing of health data. (B) A clear and concise statement of the categories of such data collected, retained, used, or disclosed by the covered entity. (C) A clear and concise statement of the covered entity's purposes for the collecting, retaining, using, or disclosing of such data. (D) A list of the specific third parties to which the covered entity discloses such data, and a clear and concise statement of the purposes for which the covered entity discloses such data, including how the data may be used by each such third party. (E) A list of the specific third parties from which the covered entity has collected such data, and a clear and concise statement of the purposes for which the covered entity collects such data. (F) A clear and concise statement describing the extent to which an individual may exercise control over the collecting, retaining, using, and disclosing of health data by the covered entity, and the