Question: A client has a small rehab clinic. They do everything using paperwork .

There about 5-6 doctors. So it is a multi-user app.
They need to keep some forms, medical records etc about each patient.
There are some security/privacy requirements.Doctors should not be able to see each other stuff.Like physio seeing psychiatrist notes for a patient.
Forms are somewhat big and would require dozen of columns in a relational database.
Those who certify the clinic with ISO stated that certified software must be used. However asking what certified software is they responded MS Access. I don't get how MS Access out of the box is certified for storing medical records without developing some forms, vba code etc.

So is MS Access more suitable than a simple web based local app using a database for storage ? I dont have much experience with MS Access and if I go this road then I wont be able to keep up with the deadline as I have zero time to learn access (having other projects running)

Answer: 
I don't know anything about certifications but I wouldn't use Access for storage. I would use it for the user interface and use SQL Express for storage. You can link the tables into Access and use them there.
Later if you want a web interface you can do it either using Access itself or ASP.NET. 
The thing with Access is that it can quickly end up being corrupted when one of the clients connected to it crashes. This happened to a client of mine long time ago and I learned my lesson. Luckily he had taken a copy the night earlier.
Hope this helps!
If it's just you or your team is less than 5 people developing, look at Visual Studio Community and adding on LightSwitch rather than Access. It's kind of midway between Access and ASP.NET.

With only 5-6 people inputting data, for the database you can use SQL Server Express to store up to 10 GB for free (and install advanced services if you need reporting). 

One word of warning (I'm not a lawyer, you'll need one), with medical data, there's loads of compliance issues, including but not limited to state and federal privacy regulations (HIPAA). If your software isn't compliant and you sell it as such, you can potentially be held liable, etc.

There's a writeup on Microsoft Blogs at <http://goo.gl/NoK719> about Visual Studio and LightSwitch.

Or you could check out OpenEMR (<http://open-emr.org>) since it's open source and has a load of certifications.