-   Securely delete PHI when there is no longer a business need for its
    retention on the device
-   Do not cache sensitive data
-   Minimize the frequency of asking for user credentials.
-   Minimize the use of APIs that access sensitive or personal user data
-   Consider a logical way to hash and de-anonymize the user data
-   Some jurisdictions may require you to provide a privacy policy for
    accessing personal information.
