; or (iv) to a contractor or agent for purposes of health plan administration, if such contractor or agent agrees, in writing, to abide by the same use and disclosure restrictions as the plan sponsor. (C) Relationship to HIPAA regulations With respect to the regulations promulgated by the Secretary of Health and Human Services under part C of title XI of the Social Security Act ( 42 U.S.C. 1320d et seq. ) and section 264 of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 ), subparagraph (B) does not prohibit a covered entity (as defined for purposes of such regulations) from any use or disclosure of health information that is authorized for the covered entity under such regulations. The previous sentence does not affect the authority of such Secretary to modify such regulations. (D) Enforcement (i) In general The powers, procedures, and remedies provided in section 207 of the Genetic Information Nondiscrimination Act ( 42 U.S.C. 2000ff–6 ) to a person alleging a violation of title II of such Act shall be the powers, procedures, and remedies this subparagraph provides for any person alleging a violation of this paragraph. (ii) Prohibition against retaliation No person shall discriminate against any individual because such individual has opposed any act or practice made unlawful by this paragraph or because such individual made a charge, testified, assisted, or participated in any manner in an investigation, proceeding, or hearing under this paragraph. The remedies and procedures otherwise provided for under this subparagraph shall be available to aggrieved individuals with respect to violations of this clause. (5) Reporting with respect to group health plans offered by small employers For plan years beginning on or after January 1, 2025, not less frequently than annually, an entity providing pharmacy benefit management services on behalf of a group health plan that is not a covered group health plan shall submit to the plan sponsor of such group health plan a report in