A long time ago I took over a Housing Association application and discovered that the forms for every single aspect of the database were in a single program and thus anyone who need access to, say, property maintenance schedules could see anything else, such as rent arrears for any tenant. I made a start on unpicking it before I left. Back in the day neither the original client nor the developers seemed to have noticed nothing wrong with the original version of that. It sounds as if someone at WHA might not have either.