Minimization and records of access by employees and contractors

(a) Minimization A covered entity shall restrict access to personal information and contents of communications by the employees or contractors of such covered entity based on an articulated balance between the potential for privacy harm, reasonable expectations of individuals to whom the personal information relates, and reasonable business needs. (b) Records of access (1) In general A covered entity shall maintain records identifying each instance in which an employee or a contractor of such covered entity accesses personal information or contents of communications if disclosing such personal information or contents of communication, or a data breach or data-sharing abuse involving such personal information or contents of communication, may foreseeably result in increased privacy harms. (2) Information required The records required by paragraph (1) shall include the following: (A) A unique identifier for the employee or contractor accessing personal information or contents of communications. (B) The date and time of access. (C) The fields of information accessed. (D) The individuals whose personal information was accessed or the contents of whose communications were accessed. (3) Small businesses excluded This subsection does not apply to a small business.