HIPAA does require the data to be stored in a secured way. It also requires a certain level of security to get to the data. Don&#x27;t let the name fool you.<p>Your second point is extremely valid.  You can&#x27;t really restrict a medical professional from looking up health information. It could cause loss of life. Mostly, a large organization can&#x27;t be expected to lock down the data of an individual.<p>What you can do is log the access (GxP regulations). This means that you will know who accessed the data after the fact.