Collections of computerised personal health data present a very real threat to privacy. Access control is difficult to manage in order to maintain privacy and at the same time to retain flexibility of usage. The legal situation is clear, imposing a requirement to respect personal privacy and human rights. Primary users (those whose access is based on a duty of care) may exceed their authorisation and access records where they have no duty of care or need to know. Secondary users (those generating analyses, research reports and financial management data) may be given access to datasets containing identifiers which are not required for their work. The 'owners' of the data (e.g. government) may use them in ways that are inconsistent with the permissions under which the data were provided (e.g. by permitting links to other databases to create 'new' information), behind closed doors and without independent audit. Currently there is a crisis emerging in which professionals are arguing that they are being compelled to compromise their ethical responsibilities to their patients, and government is responding that their measures are necessary to preserve access to quality data for research and planning. This paper proposes an integrated plan for managing these issues in a manner that is ethically sustainable, as well as in keeping with all provisions of the law, using a personal health card.