9 V.S.A. § 2449b: Exclusions [Effective January 1, 2027]

This subchapter does not apply to:

(1) a federal, state, tribal, or local government entity in the ordinary course of its operation;

(2) protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, HIPAA;

(3) information used only for public health activities and purposes described in 45 C.F.R. § 164.512;

(4) information that identifies a consumer in connection with:

(A) activities that are subject to the Federal Policy for the Protection of Human Subjects as set forth in 45 C.F.R. Part 46;

(B) research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;

(C) activities that are subject to the protections provided in 21 C.F.R. Part 50 and 21 C.F.R. Part 56; or

(D) research conducted in accordance with the requirements set forth in subdivisions (A)–(C) of this subdivision (4) or otherwise in accordance with State or federal law;

(5) an entity whose primary purpose is journalism as defined in 12 V.S.A. § 1615(a)(2) and that has a majority of its workforce consisting of individuals engaging in journalism; and

(6) a financial institution subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act.