Serving as a chief privacy officer in this era of increased scrutiny and threats requires a keen understanding of all the places protected health information (PHI) can lurk—and potentially be exposed—in a large health organization.

That’s the word from four chief privacy officers who spoke March 27 at the National HIPAA Summit. Still, they emphasized that it’s probably not possible to address every threat, given the realities of staffing and budgets, so privacy officers need to identify their most important priorities. The privacy officers outlined what they consider their top targets.

“It’s like playing whack-a-mole,” says Shauna Van Dongen, chief privacy officer at Providence St. Joseph Health in Seattle, Washington.

The changing models in health care delivery lead to “an insatiable desire for information,” says Van Dongen. “How do we allow access that’s permissible, while still putting controls into place?” For example, she says, developers working on apps meant to be used in health care may never have worked in his industry before, and they may be surprised that email addresses used within the app are PHI.