That's absolutely false. Many other people need to be able to access the data just to keep systems working. I've worked in a HIPAA environment (as well as FDA class 1 / ISO 13485) for nearly 15 years now.