(b) A person or entity, not including a government entity, must restrict access to individual Social Security numbers it holds so that only employees who require the numbers in order to perform their job duties have access to the numbers, except as required by titles XVIII and XIX of the Social Security Act and by Code of Federal Regulations, title 42, section 483.20. (c) Except as provided in sub