Securing the PII 'crown jewels' of health IT systems