; and (B) made publicly available in a prominent location on an ongoing basis. (2) Timing The privacy policy required by subsection (a) shall be made available as required by paragraph (1) before the covered entity collects personal information after the effective date of this Act. (e) Small businesses excluded Subsections (b)(7) and (d) do not apply to a small business. (f) Service providers excluded This section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes, maintains, or discloses personal information is in compliance with this section. 212. Information security requirements (a) In general A covered entity shall establish and implement reasonable information security policies, practices, and procedures for the protection of personal information collected, processed, maintained, or disclosed by such covered entity, taking into consideration— (1) the nature, scope, and complexity of the activities engaged in by such covered entity; (2) the sensitivity of any personal information at issue; (3) the current state of the art in administrative, technical, and physical safeguards for protecting such information