EDIT: After looking more into your claim that "N+1 queries aren't possible with Ecto", I think I have a better idea for what you might mean. Perhaps you don't want everything eager loaded, but you want an exception to be raised if you try to access an associated record that hasn't been preloaded. I suppose that's a fair point (probably good practice if having any N+1 queries will be a major problem in your project, or if subpar performance really is your biggest threat), and no, I don't know of a way to do that in AR.
https://maps.app.goo.gl/6ssyJfjVn1fUGaG2A
Turns out, it's pretty relevant to the situation - especially how the unauthorized access was possible.
This wasn't your typical hospital MRI. This is basically your local tanning salon that somehow acquired an MRI machine.