forth in Section II.a of this Agreement. 5. 45 CFR 155.260(b) provides that an Exchange must, among other things, require privacy and security standards that are consistent with the principles in 45 CFR 155.260(a)(1) through (a)(6) and with 45 CFR 155.260(b)(3), as a condition of contract or agreement.