(but not increased significant privacy harms) and the purpose is not substantially similar to the purpose for which such personal information was originally collected, so long as the personal information is secured using privacy-preserving computing. (3) Notice and consent required For scenarios not covered under paragraph (1) or (2), and notwithstanding sections 208(b)(2) and (3), a covered entity shall provide notice of and obtain consent for ancillary collecting, processing, maintaining, or disclosing of personal information. (d) Substitution In cases in which personal information can be replaced with artificial personal information, personal information that has been de-identified, or the random personal information of one or more individuals without substantially reducing the utility of the data or requiring an unreasonable amount of effort, such a replacement shall take place. 202. Minimization and records of access by employees and contractors (a) Minimization A covered entity shall restrict access to personal information and contents of communications by the employees or contractors of such covered entity based on an articulated balance between the potential for privacy harm, reasonable expectations of individuals to whom the personal information relates, and reasonable business needs. (b) Records of access (1) In general A covered entity shall maintain records identifying each instance in which an employee or a contractor of such covered entity accesses personal information or contents of communications if disclosing such personal information or contents of communication, or a data breach or data-sharing abuse involving such personal information or contents of communication, may foreseeably result in increased privacy harms. (2) Information required The records required by paragraph (1) shall include the following: (A) A unique identifier for the employee or contractor accessing personal information or contents of communications. (B) The date and time of access. (C) The fields of information accessed.