I work at a company that stores highly confidential PII. Statements from doctors and the like are just some of the documents our system handle. We're not that

I work at a company that stores highly confidential PII. Statements from doctors and the like are just some of the documents our system handle. We're not that concerned. The general consensus is be responsible with the data, make it possible to actually delete something, and show reasonable effort to implement the directives or have a reasonable plan on how and when to implement it reasonably. It's not a big deal as this is how it should have been done in the first place. Only not it's formalized into law.