Most privacy problems are justdata nobody needed to hold.

Every field on a form is a field somebody has to protect for years. If a workflow does not genuinely need a piece of information, the honest answer is to stop asking for it.

Being allowed into a record is not the same as being handed all of it. A pharmacist checking a prescription does not need the family's phone number, so it does not travel.

Some things do not need to be exact. A research extract can use a year of birth instead of a date, and a subject number instead of a name — the clinical picture survives, the person is not identifiable from it.

Retention is a decision, not an accident. How long each kind of record lives is agreed with you up front and then actually enforced, rather than everything living forever because nobody chose.

Integrations are where privacy quietly leaks. Every connection has an agreed set of fields, and adding one is a decision someone makes on purpose rather than a side effect.

When a patient asks who has seen their record, that should be a query rather than an investigation. The same trail that supports security supports answering them honestly.