(b) Privacy Risk Assessment- A covered entity shall conduct an assessment of the risks to individuals raised by the collection, use, and disclosure of covered information or sensitive information prior to the implementation of commercial projects, marketing initiatives, business models, applications, and other products or services in which the covered entity intends to collect, or believes there i