Prohibition on re-identification

(a) In general Except as required under title I, a covered entity shall not use personal information collected from an individual, acquired from a third party, or acquired from publicly available information to re-identify an individual from de-identified information. (b) Third-Party prohibition A covered entity that discloses de-identified information to a third party shall prohibit such third party from re-identifying an individual using such de-identified information. (c) Exception Subsection (a) shall not apply to qualified research entities, as determined by the Director, conducting research not for commercial purposes.