The tricky bit is the interplay between security and criticality of need.

If I'm dying of an unknown condition in the ER, I really want minimal fences between my doctor and my data. So a careful balance has to be struck because sometimes patient need is served by breaking privacy. Bulletproof technical solutions could impede patient care.