When I worked on an electronic medical record, the system had a concept called "break the glass". Any record could be accessed, but if that access was not whit

When I worked on an electronic medical record, the system had a concept called "break the glass". Any record could be accessed, but if that access was not whitelisted as normal for a particular time, place, person, and purpose, the user would be presented with a warning that their access would be recorded and flagged for subsequent auditing, to determine if it was appropriate or not. They could then click through to access the record. If a care team needed to know right now whether a patient was allergic to medication X, the computer nurse would click through. If someone was just trying to look at the inpatient dietary orders of a celebrity, the warning would likely scare them off and protect patient privacy. But the important difference there is that the person accessing was not given a digital copy of the record they were accessing, unless they photographed the screen with their phone. If you release one thing over the web to one person, you permanently lose all access control over that thing. If the system records that one person looked up all the records, well now you know who to go to when you want to look at the records anonymously.