1. This chapter shall not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act. The licensee shall annually submit to the commissioner a written certification of the licensee’s compliance with HIPAA.
2. This chapter shall not apply to a licensee that is owned or controlled by a federally insured depository institution that is subject to, and in compliance with, the Gramm-Leach-Bliley Act or comparable federal law and corresponding regulations.
3. A licensee shall have one hundred eighty days from the date the licensee no longer qualifies for exemption under subsection 1 or 2 to comply with this chapter.