Protecting patient privacy in healthcare oversight