(1) Except as provided in subsections (2) to (4) of this section, a person or entity may not do any of the following:

(a) Publicly post or publicly display in any manner an individual's social security number. "Publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public.

(b) Print an individual's social security number on any card required for the individual to access products or services provided by the person or entity;

(c) Require an individual to transmit his or her social security number over the internet, unless the connection is secure or the social security number is encrypted;

(d) Require an individual to use his or her social security number to access an internet website, unless a password or unique personal identification number or other authentication device is also required to access the internet website; and

(e) Print an individual's social security number on any materials that are mailed to the individual, unless state or federal law requires, permits, or authorizes the social security number to be on the document to be mailed. Notwithstanding this paragraph (e), social security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend, or terminate an account, contract, or policy, or to confirm the accuracy of the social security number. A social security number that is permitted to be mailed under this section may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened.

(2) (a) A person or entity that has used, prior to January 1, 2007, an individual's social security number in a manner inconsistent with subsection (1) of this section, may continue using that individual's social security number in that manner on or after January 1, 2007, if all of the following conditions are met:

(I) The use of the social security number is continuous. If the use is stopped for any reason, subsection (1) of this section shall apply.

(II) The person or entity provides the individual with an annual disclosure that informs the individual that he or she has the right to stop the use of his or her social security number in a manner prohibited by subsection (1) of this section.

(b) The person or entity shall implement a written request by an individual to stop the use of his or her social security number in a manner prohibited by subsection (1) of this section within thirty days after the receipt of the request. The person or entity may not impose a fee or charge for implementing the request.

(c) The person or entity shall not deny services to an individual because the individual makes a written request pursuant to paragraph (b) of this subsection (2).

(3) This section shall not prevent the collection, use, or release of a social security number as required, permitted, or authorized by state or federal law or the use of a social security number for internal verification or administrative purposes, including by the department of revenue.

(4) This section shall not apply to:

(a) Documents or records that are recorded or required to be open to the public pursuant to the constitution or laws of this state or by court rule or order, and this section shall not limit access to these documents or records; or

(b) An entity that is subject to the federal "Health Insurance Portability and Accountability Act of 1996", as amended, 42 U.S.C. sec. 1320d to 1320d-9.