I've worked with anonymized patient data in the U.S. at a small consulting firm nobody's ever heard of. We received encrypted physical media via USPS and regist

I've worked with anonymized patient data in the U.S. at a small consulting firm nobody's ever heard of. We received encrypted physical media via USPS and registered mail. It may seem byzantine, but we also worked exclusively on air-gapped servers. Best practice in data security is pretty straightforward - you don't connect data to the internet if a single breach is catastrophic. We talk about things like the Target hack as catastrophic breaches, but they aren't. You can change your password or cancel your credit card. You can't change your medical history - once public, it is always public.