Information protection and privacy safeguards

(a) Compliance with privacy laws The Attorney General shall handle all information obtained under section 2 in accordance with section 552a of title 5, United States Code (commonly known as the Privacy Act of 1974), and, where applicable, the regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d–2 note). (b) Security protocol The Attorney General shall establish information security protocols to ensure that information transferred from a State agency— (1) is encrypted using industry-standard protocols; (2) may only be accessed by authorized personnel; and (3) is destroyed and permanently removed from any database upon the conclusion of the relevant legal proceedings or investigation. (c) Limitation on use A Federal agency may only use information obtained under this Act for law enforcement purposes related to fraud, and may not disclose such information for any unrelated administrative or commercial purpose.