§ Â 8609. Exceptions.

(a) The following exceptions apply to this chapter:

(1) A licensee with fewer than 15 employees is exempt from § 8604 of this chapter.

(2) A licensee subject to the Health Insurance Portability and Accountability Act [P.L. 104-191, as amended] that has established and maintains an information security program under the statutes, rules, regulations, procedures, or guidelines established thereunder, is considered to meet the requirements of § 8604 of this title, if the licensee is compliant with, and submits a written statement certifying its compliance, the same.

(3) A licensee’s employee, agent, representative, or designee, who is also a licensee, is exempt from § 8604 of this title and is not required to develop the employee’s, agent’s, representative’s, or designee’s own information security program to the extent that the employee, agent, representative or designee is covered by the other licensee’s information security program.

(b) Nothing in this chapter creates a duty or liability for a provider of communication services for the transmission of voice, data, or other information over its network.

(c) If a licensee ceases to qualify for an exception under this section, the licensee has 180 days to comply with this chapter.