Achieving the Right Balance: Privacy and Security Policies to Support Electronic Health Information Exchange