Guide

The eight exceptions: harm, privacy, and the documentation they need

Summary

You may lawfully delay or withhold electronic health information only when one of eight information-blocking exceptions genuinely applies — Preventing Harm, Privacy, Security, Infeasibility, Health IT Performance, Content and Manner, Fees, and Licensing — each with its own conditions. None is a general discretion to withhold something because it feels sensitive; each requires contemporaneous documentation showing your practice was narrow, consistent, and matched to that exception's actual criteria.

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What invoking an exception actually requires

The information-blocking rule assumes you'll share electronic health information unless one of eight defined exceptions genuinely applies to your specific situation — it is not a rule you can invoke by feeling uneasy about a request. Each exception has its own conditions, and meeting them requires more than good intentions: it requires documentation showing your practice was consistent, narrowly tailored, and based on the exception's actual criteria, not a blanket policy 1Ref 1Office of the National Coordinator / ASTP (2026).Information Blocking.That the 21st Century Cures Act prohibits interfering with access to electronic health information subject to eight defined exceptions, and that clinicians are actors under the rule — the framework the whole article explains..

The eight exceptions are carve-outs from an open notes default, not a replacement for it — the starting assumption is still disclosure.

Exception	What it's for
Preventing Harm	A genuine, patient-specific risk of physical harm from sharing certain information
Privacy	Complying with a precondition the law imposes — a minor-consent rule, a request not to share, a required-by-law limit
Security	Protecting the confidentiality, integrity, and availability of health IT, applied consistently
Infeasibility	You genuinely cannot fulfill the request given available technology or resources
Health IT Performance	Necessary maintenance or a temporary unavailability of the system itself
Content and Manner	Choosing among reasonable options for content and format when more than one exists
Fees	Charging a reasonable, cost-based fee for the exchange
Licensing	Reasonable, non-discriminatory licensing terms for interoperability elements you develop

The Preventing Harm Exception

The Preventing Harm Exception exists for a genuine, patient-specific risk — a reasonable belief that sharing a particular piece of information would likely endanger the life or physical safety of the patient or someone else — not a general worry that information might upset someone or complicate a conversation you'd rather have in person.

Document the specific basis at the time — what you believed, why, and what information you withheld — rather than relying on a general practice policy that treats an entire category of notes as automatically exempt.

The Privacy Exception

The Privacy Exception lets you decline to share information when doing so is required by an actual precondition the law imposes — for instance, a state consent rule for a minor's records, or a patient's own request that specific information not be shared with a particular person or system. HIPAA's Privacy Rule sets much of that underlying framework: what counts as protected health information, and when disclosure requires authorization in the first place 2Ref 2HHS Office for Civil Rights (2026).Summary of the HIPAA Privacy Rule.That the Privacy Rule defines protected health information and when disclosure requires authorization, supporting the explanation of what underlies the information-blocking Privacy Exception..

A common trigger is a personal representative's request on behalf of a minor or an incapacitated adult. HIPAA defers to state law on who controls those records and permits a narrow exception where there's a reasonable belief of abuse, neglect, or endangerment 3Ref 3HHS Office for Civil Rights (2026).Personal Representatives.That HIPAA defers to state law on who controls a minor's or incapacitated adult's records and permits a narrow exception in abuse/endangerment situations, supporting the Privacy Exception discussion of personal-representative requests. — this is exactly the tension behind the teen portal question, where an adolescent's own access can legitimately differ from a parent's. Handling the subpoena is a different mechanism entirely: a court order authorizes only what it specifically orders, while a subpoena without a court order requires satisfactory assurances of notice or a protective order before you disclose anything 4Ref 4HHS Office for Civil Rights (2026).Court Orders and Subpoenas.That a court order authorizes only what it specifically orders while a subpoena without a court order requires satisfactory assurances of notice or a protective order, supporting the distinction drawn between the Privacy Exception and legal-process disclosures..

The Security, Infeasibility, and Health IT Performance exceptions

Three exceptions cover situations where the constraint is technical or organizational rather than about the patient relationship: the Security Exception lets you withhold access to protect the confidentiality, integrity, or availability of health IT, applied under a consistent organizational policy rather than an ad hoc judgment call; the Infeasibility Exception covers requests you genuinely cannot fulfill given your actual technology or resources; and the Health IT Performance Exception covers necessary maintenance or a temporary system outage.

None of the three excuses an indefinite delay. Each covers the actual duration of the constraint — the maintenance window, the outage, the specific security measure — not an open-ended policy dressed up as a technical limitation.

The three procedural exceptions

The remaining three exceptions govern how, not whether, you respond: the Content and Manner Exception lets you choose among reasonable options when more than one way exists to fulfill a request; the Fees Exception permits a reasonable, cost-based charge rather than requiring you to absorb every export for free; and the Licensing Exception lets you set reasonable, non-discriminatory terms if you've built an interoperability element others want to license.

When the request arrives through a third-party app rather than your portal directly, the same eight exceptions still apply — the app request doesn't create a separate, stricter standard, and it doesn't create a looser one either.

How this differs from the HIPAA access right

An information-blocking exception and a HIPAA access-right denial are two different legal frameworks, not interchangeable labels for "I'd rather not." HIPAA separately entitles patients to a copy of their records in the format they request, within 30 days with one 30-day extension available, and explicitly excludes psychotherapy notes from that right — a distinct carve-out from anything in the information-blocking exceptions 5Ref 5HHS Office for Civil Rights (2026).Individuals' Right under HIPAA to Access their Health Information.That patients have a right to a copy of their records in the requested form and format within 30 days plus one extension, with psychotherapy notes excluded, supporting the distinction between the HIPAA access right and the information-blocking exceptions..

This is also distinct from the immediate release of test results directly to patients, which runs on its own separate timing rule. Know which framework a given request actually falls under before you decide anything is being withheld or delayed.

Documenting your basis so it holds up later

Whichever exception you invoke, the same three habits make it defensible later: write down your reasoning at the time, not in hindsight after a complaint arrives; apply the same standard consistently rather than case by case depending on the patient; and keep the withholding as narrow as the exception actually allows, releasing everything else on the normal timeline.

A one-line contemporaneous note — which exception, what was withheld, why — takes less time to write than it will ever take to reconstruct from memory if the decision is ever questioned.

Common questions

No — general discomfort isn't a recognized exception. The Preventing Harm Exception requires a reasonable belief that sharing a specific piece of information would likely endanger someone's life or physical safety, not a worry that the content is emotionally difficult to read.

Not always — HIPAA defers to state law on who controls a minor's records, and a narrow exception applies where there's a reasonable belief of abuse, neglect, or endangerment. The question often depends on state minor-consent law rather than a single national rule.

A reasonable, cost-based fee is generally permitted under the Fees Exception, but it isn't the same fee framework as the separate HIPAA access-right fee rules that apply when a patient formally requests their own records. Check which framework the specific request falls under before setting a price.

Yes, temporarily — the Health IT Performance Exception covers necessary maintenance and unplanned system unavailability, but only for the duration of the actual disruption. It isn't a basis for an indefinite delay once the system is back and functioning normally.

Yes, and at the time, not afterward. Write down what you withheld, which exception applies, and why, consistently across similar situations — that contemporaneous record is what turns a defensible decision into one you can actually defend if it's ever questioned.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Office of the National Coordinator / ASTP (2026). Information Blocking. HealthIT.gov. link ✓That the 21st Century Cures Act prohibits interfering with access to electronic health information subject to eight defined exceptions, and that clinicians are actors under the rule — the framework the whole article explains.
2.HHS Office for Civil Rights (2026). Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services. linkThat the Privacy Rule defines protected health information and when disclosure requires authorization, supporting the explanation of what underlies the information-blocking Privacy Exception.
3.HHS Office for Civil Rights (2026). Personal Representatives. U.S. Department of Health and Human Services. linkThat HIPAA defers to state law on who controls a minor's or incapacitated adult's records and permits a narrow exception in abuse/endangerment situations, supporting the Privacy Exception discussion of personal-representative requests.
4.HHS Office for Civil Rights (2026). Court Orders and Subpoenas. U.S. Department of Health and Human Services. linkThat a court order authorizes only what it specifically orders while a subpoena without a court order requires satisfactory assurances of notice or a protective order, supporting the distinction drawn between the Privacy Exception and legal-process disclosures.
5.HHS Office for Civil Rights (2026). Individuals' Right under HIPAA to Access their Health Information. U.S. Department of Health and Human Services. linkThat patients have a right to a copy of their records in the requested form and format within 30 days plus one extension, with psychotherapy notes excluded, supporting the distinction between the HIPAA access right and the information-blocking exceptions.

https://www.gale.care/for-providers/cde-info-blocking-exceptions · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers