Comment by chrisseaton

> There's no good reason to have personally identifiable information stored in the system.

They’re medical records. Seems inherently likely to be PII?