(1) "Personally identifiable information" sufficient to trigger a notice to certificate holders as described in 33-19-202 (2) (a) , MCA, does not include names, addresses, birth dates and identification numbers, used in any combination as personal identifiers obtained for the sole purpose of verifying eligibility for insurance coverage, provided that the insurance institution does not use that information for any purpose other than verifying benefits, does not collect further information, or disclose any personal information about that individual outside the provisions of 33-19-306 (7) , MCA, and does not use this information for any marketing purpose.

(2) A notice to individual certificate holders is required if further information is collected, or personal information is used for purposes other than for eligibility determination, or disclosed for any other purpose, including disclosures to affiliates.