This subchapter does not apply to:
(1) a federal, state, tribal, or local government entity in the ordinary course of its operation;
(2) protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, HIPAA;
(3) information used only for public health activities and purposes described in 45 C.F.R. § 164.512;
(4) information that identifies a consumer in connection with:
(A) activities that are subject to the Federal Policy for the Protection of Human Subjects as set forth in 45 C.F.R. Part 46;
(B) research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;
(C) activities that are subject to the protections provided in 21 C.F.R. Part 50 and 21 C.F.R. Part 56; or
(D) research conducted in accordance with the requirements set forth in subdivisions (A)–(C) of this subdivision (4) or otherwise in accordance with State or federal law;
(5) an entity whose primary purpose is journalism as defined in 12 V.S.A. § 1615(a)(2) and that has a majority of its workforce consisting of individuals engaging in journalism; and
(6) a financial institution subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act.