"To say that it's 'better', yet still be insecure is like saying that you'd rather be shot than nibbled to death by rats - the end result is still death (or in this case dataloss)." On the other hand, given my records are evidently insecure at the moment, and there is no audit trail on who has access, moving to a system where there is an audit trail of who has access, even if it is still insecure, may be a step in the right direction. The end result may still be that someone can view my records who shouldn't be able to, but at some point in the future those records may be available to me when they previously couldn't be, and therefore may be of some practical use. Tbh, my experience is of the northern solution(s) rather than the London ones. It may be that if I had the same experiences as you, Tom, I may have the same reservations. No idea what PEBUAK is. Answers on a postcard to...? Axy