User access to Highly Sensitive Data

Hi,

I am trying to identify those users who have access to what we determine to be highly sensitive/confidential data (SSN, National ID, Bank and Account numbers).  I have a sql that selects from the security, pages, field and record field tables.  Our need is to drill down to those users who actually can see this data.  So with this sql, I need to eliminate those where the field is hidden on the page.  Has anyone had to do this type of research or produce a similar report?

 

I am aware that there various ways that a field can be made unavailable for viewing and/or editing (via the page, peoplecode, etc.).  However, and looking for suggestions to gather this information.