If this ability to decrypt data exists, you have yet another layer for the FOI request. You must track each and every time a patient's data was decrypted and b

If this ability to decrypt data exists, you have yet another layer for the FOI request. You must track each and every time a patient's data was decrypted and by whom, and that information must be available as well. Information that you'll probably also need to encrypt, but still be able to search by patient, date, and decrypter. (requests come through to find all records a particular employee has seen within a certain date range as well) I can see the start of a rabbit hole, which is why organisations dealing in PID have IG teams or consultants who know the laws and know how much needs to be done. If a patient thinks an organisation is holding out on them, that patient has a way to complain, and the complaints aren't taken lightly from what I've seen.