An emergency department needs any clinician to reach any patient's record within seconds, while the privacy office requires minimum-necessary access. Which control set satisfies both?

The mechanism that makes both true

Minimum necessary is not a smaller role. It is access derived from a relationship that exists in the data: this clinician is on the care team for this patient, in this encounter, now. Relationship-based access changes as care changes, which is why it does not need a role explosion.

Emergency care breaks any relationship model, because the relationship is created by the emergency. So the design needs a deliberate exception path rather than a permanently loose default: self-declared break-glass, with a reason code, an expiry measured in hours, a banner telling the clinician the access is recorded, and a review queue.

The review is the control. The log is only the evidence. An audit trail nobody reads is a compliance artefact, not a protection.

The number that tells you it is working

Break-glass should stay under about 5% of accesses. If a third of accesses go through the override, the relationship model does not match how care actually happens, and clinicians have routed around it. The threshold is also set by review capacity: if a privacy team can review 200 events a week, a design that produces 5000 a week is a design that produces no review. That is the real trade-off in this pattern — every additional override you tolerate costs you the review that makes the log worth keeping, and the US Privacy Rule's minimum-necessary standard, in force since 2003, has always been about the access decision rather than the audit trail.

Why the other options fail

• Role-wide read plus audit. This is the common implementation and it is the weak one: at hundreds of thousands of reads a day, nothing distinguishes a legitimate access from a curious one, so the audit cannot be reviewed and the deterrent disappears. It also fails the question a regulator asks after an incident — not "who accessed it" but "why was that access possible".
• Second-clinician approval for every access. Correct-looking and clinically unsafe. It adds minutes to an emergency, so it will be bypassed with shared accounts, which is worse than the problem it solves. Dual control belongs on bulk export, not on bedside reads.
• Only patients with an open encounter at that facility. This is the right default and an incomplete answer. It denies the transferred patient, the on-call specialist advising remotely, and the ambulance handover, which is exactly when the record matters most.

When not to build this

A research data mart should have no break-glass at all. There is no emergency in analytics, so the correct design is de-identified data, an approval workflow for anything else, and no override path. Copying the clinical pattern into the warehouse gives you an emergency door into a building with no emergencies.