There are three exceptions. The first applies to unintentional “good faith” acquisitions or uses of PHI by a workforce member provided the PHI will not be further used or disclosed without authorization. The second applies when a similar good faith acquisition occurs between a Covered Entity and a Business Associate. The third exception is when a good faith belief exists that the person to whom an impermissible disclosure was made will not have been able to retain the information.