Taking care is an obvious consideration, but the biggest thing that many companies miss is to have a separation between a sandbox where a developer can feel comfortable experimenting without having to worry about exposing/clobbering sensitive data, and a more serious environment where they can take their ideas and test them in real scenarios. So when I think of handling PHI, I think like an engineer in that it is better to build the system for safety, rather than have to "try really hard" to not accidentally expose sensitive data at all times, which can be exhausting and be accident-prone.