How to protect patient records and maintain governance?