Minimum Necessary Access
Restricting each user to the health information required for their specific role and, in the strong form, to the patients they are actually treating.
Health information carries stricter expectations than most personal data, and the principle that shapes the architecture is that access should be no broader than the task requires.
The weak implementation is role-based: a clinician role can read clinical records. This satisfies an auditor superficially and permits any clinician to read any patient's record, which is where high-profile breaches come from — staff looking up relatives, colleagues or public figures.
The strong implementation binds access to a treatment relationship. A clinician can read records for patients on their ward, on their caseload, or with a booked appointment. Everything else requires a break-glass action: available, because emergencies are real, but requiring a stated reason, alerting immediately, and subject to review.
The properties this demands of the design are an authoritative source of the care relationship, real-time policy evaluation rather than periodic provisioning, and comprehensive access logging — because with any emergency override, detection and review are the actual control rather than prevention.
The same shape applies to research use, where the correct arrangement is de-identified data by default with re-identification requiring separate approval.