; (B) the sensitivity of the covered data collected, processed, and stored and the associated privacy risk; and (C) the currently available and widely accepted technological, administrative, and physical means to protect covered data under the control of the covered entity; (D) the cost associated with implementing, maintaining, and regularly reviewing the safeguards; and (E) the impact of these requirements on small and medium sized businesses. (2) Limitations In promulgating the regulations required under this section, the Commission shall consider a covered entity who is in compliance with existing information security laws that the Commission determines are sufficiently rigorous to be in compliance with this section with respect to particular types of covered data to the extent those types of covered data are covered by such law, including the following: (A) Title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq. ). (B) The Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 ). (C) The Health Insurance Portability and Accountability Act of 1996 Security Rule (45 CFR 160.103 and part 164). (D) Any other existing law requiring a covered entity to implement and maintain information security practices and procedures that the Commission determines to be sufficiently rigorous. 7. Privacy protection officers (a) Appointment of a privacy protection officer Each covered entity with annual revenue in excess of $50,000,000 the prior year shall designate at least 1 appropriately qualified employee as a privacy protection officer who shall— (1) educate employees about compliance requirements; (2) train employees involved in data processing; (3) conduct regular, comprehensive audits to ensure compliance and make records of the audits available to enforcement authorities upon request; (4) maintain updated, clear, and understandable records of all data security practices undertaken by the covered entity