Where there is no medical need to do so. Many hospitals and large institutions have HER system with role-based access controls to limit, for example, food service employer or billing clerks from accessing sensitive clinical information, but there are generally no limits on the scope of information available to physicians, nurses, pharmacists, and other health professionals with direct patient care responsibilities