While healthcare organizations should avoid information blocking, they also must remain focused on keeping confidential patient health information private and secure to maintain compliance with HIPAA . The ONC addresses this concept in two of the information blocking rule’s eight exceptions. The Privacy Exception The privacy exception indicates an activity will not be considered information blocking if an actor does not fulfill an EHI request in order to protect an individual’s privacy, provided certain conditions are met. This exception suggests that an actor should not be required to use or disclose EHI in a way that is prohibited under state or federal privacy laws. For example, if the provider is required to obtain consent before sharing patient information with another healthcare entity, it may delay sharing the information until it receives consent. This delay is not information blocking. Similarly, if a patient has requested that their information not be shared, the provider has the right not to share the information. The Security Exception The security exception also pertains to HIPAA. This exception states that an activity will not be considered information blocking if it is done to protect the security of EHI, provided certain conditions are met. This exception is intended to cover all legitimate security practices but does not prescribe a maximum level of security or dictate a one-size-fits-all approach. To fit within the security exception, an activity must be directly related to safeguarding EHI’s confidentiality, integrity, and availability; tailored to specific security risks; and implemented in a consistent and non-discriminatory manner.