>
No, the real issue is that external contractors diving into patient databases bears no resemblance to an application saving data into the database. How the application saves the data has nothing to do with it.
>

I don't see that as the issue at all. If you write software to act on data - you need access to the data...period. What you do is sign an NDA. Obviously, you limit the access by contractor.

JR - I am in an almost identical situation myself - so I speak from practical experience on this.