Role-Based Access Control & Minimum Necessary AccessEvery EHR user should have access to exactly the PHI they need to do their job — nothing more