The INCDPA excludes any state entity, agency, or local government organizations; third parties under contract with any state entity, agency, or local government organizations; financial institutions or affiliates already required to explain their information-sharing practices to customers under the Gramm-Leach-Bliley Act; entities subject to the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA); and non-profit organizations, higher education institutions, or public utility entities.