I worked with HIPAA data.

When I was working with the developers, the test DB they would develop against had about 65K rows of patients and about 10 facilities. The production DB had over a million residents and over a 1000 individual facilities.

They had a function that looked up the list of active therapists -- but didn't discriminate by facility id. So the function was returning over 23K lines to look for one out of maybe ten. But using the limited DB it worked well. With the production DB it sucked.

But they would never let me sanitize the Production DB to test or develop with.