Interesting - our hospital written policy is that SSNs must be encrypted when stored. Other PII is somewhat less restrictive. But, we had a high-profile case

Interesting - our hospital written policy is that SSNs must be encrypted when stored. Other PII is somewhat less restrictive. But, we had a high-profile case where a server with a file of SSNs and patient names was hacked. There was no evidence the person(s) who hacked the server ever knew this particular file existed, but it generated a bunch of headaches here. Maybe policy makers went off the deep end in response.