That’s true. It’s not just a database that has to be created. How is the database accessed? How are responses on whether a procedure can be done routed back to physicians? How is information added? Are new records transmitted to it over the internet? There will be multiple ways of intercepting information, not just the risk of the database itself.
And of course, if you’re a private citizen like Joe the Plumber who questions the all-knowing HOLY ONE - now they can give your MEDICAL information to the media as well.