§14–4802.

    This subtitle does not apply to:

        (1)    Data subject to a statute or regulation identified under item (i) of this item that is controlled by a covered entity or service provider that is:

            (i)    Required to comply with:

                1.    Title V of the federal Gramm–Leach–Bliley Act;

                2.    The federal Health Information Technology for Economic and Clinical Health Act; or

                3.    Regulations promulgated under § 264(c) of the Health Insurance Portability and Accountability Act of 1996; and

            (ii)    In compliance with the information security requirements of applicable statutes or regulations identified in item (i) of this item; or

        (2)    Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, in accordance with:

            (i)    Good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or

            (ii)    Human subject protection requirements of the U.S. Food and Drug Administration.