This part does not apply to:
(1) protected health information that is collected by a covered entity or business associate as those terms are defined in 45 C.F.R. Parts 160 and 164;
(2) a public or private institution of higher education; or
(3) an entity owned or operated by a public or private institution of higher education.