but each record might only be intended to be accessible to the patient and the patient's
doctor [R.863.2].
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid.