Do you think there are problems with any of the HIPAA Privacy Rule's exceptions to the authorization requirement? Do the exceptions minimize patient privacy? Are there too many exceptions? Are there other exception that you would include if you were asked to become involved in revising the law?