Section 56-2-1009 - Exceptions(a)(1) This part does not apply to:(A) A licensee who employs less than twenty-five (25) individuals, regardless of whether the individuals are employees or independent contractors;(B) A licensee with less than five million dollars ($5,000,000) in gross annual revenue; or(C) A licensee with less than ten million dollars ($10,000,000) in year-end total assets.(2) A licensee subject to and governed by the privacy, security, and breach notification rules issued by the United States department of health and human services, 45 CFR Parts 160 and 164, established pursuant to the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.), and the federal Health Information Technology for Economic and Clinical Health (HITECH) Act (42 U.S.C. § 300jj et seq. and 42 U.S.C. § 17901 et seq.), and that maintains nonpublic information in the same manner as protected health information meets the requirements of §§ 56-2-1004 and 56-2-1006(c) if the licensee is compliant with, and submits a written statement certifying its compliance with, the federal Health Insurance Portability and Accountability Act of 1996 and the federal Health Information Technology for Economic and Clinical Health.(3) A licensee subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 (15 U.S.C. §§ 6801-6809 and 6821-6827) that meets the requirements of § 56-2-1006(c) if the licensee is compliant with, and submits a written statement certifying its compliance with, Title V of the federal Gramm-Leach-Bliley Act of 1999.(4) An employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt from § 56-2-1004 if the activities of the employee, agent, representative, or designee are covered by the other licensee's information security program.(b) If a licensee ceases to qualify for an exception under subsection (a), then the licensee has one hundred eighty (180) days from the time the licensee no longer qualifies for the exception to comply with this part.Added by 2021 Tenn. Acts, ch. 345, s 1, eff. 7/1/2021.