Code of Federal Regulations Title 45. Public Welfare § 45.171.203 Security exception—when will an actor's practice that is likely to interfere with the access, exchange, or use of electronic health information in order to protect the security of electronic health information not be considered information blocking?

(1) Be in writing;

(2) Have been prepared on the basis of, and be directly responsive to, security risks identified and assessed by or on behalf of the actor;

(3) Align with one or more applicable consensus-based standards or best practice guidance;  and

(4) Provide objective timeframes and other parameters for identifying, responding to, and addressing security incidents.

(1) The practice is necessary to mitigate the security risk to electronic health information;  and

(2) There are no reasonable and appropriate alternatives to the practice that address the security risk that are less likely to interfere with access, exchange or use of electronic health information.