I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing access to this data in a database? Should developers be allowed unfettered access to the entire database, since it is part of their job, or are there measures to be taken to obscure or change data?