Unless otherwise explicitly authorized in statute, or with prior written authorization from the department, recipients must:

(1) Only allow protected personal information to be transmitted, accessed, viewed, stored, or processed within the United States.

(2) Maintain the primary, backup, disaster recovery, and other sites for storage of protected personal information within the United States.