Exemption for certain licensees; timeline for implementation and compliance.

(1) A licensee that has fewer than 25 employees, including any independent contractors, is exempt from section 555. (2) A licensee subject to and in compliance with the health insurance portability and accountability act of 1996, Public Law 104–191, and with regulations promulgated under that act, is not required to comply with this chapter except for the requirements under sections 559 and 561. (3) An employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt from section 555 and does not need to develop its own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the other licensee. (4) If a licensee ceases to qualify for the exception under subsection (1), the licensee has 180 days to comply with this chapter. (5) This chapter takes effect on January 20, 2021. A licensee shall implement section 555 by January 20, 2022. However, a licensee has until January 20, 2023 to implement section 555(6).