Question

A hospital's data analytics team stores patient records in a shared warehouse. Billing analysts need to see charge amounts but must not view clinical diagnosis fields, while clinical researchers need diagnosis data but should never see individual patient names or account numbers. A new analyst joins the billing team. Which access control approach BEST enforces these requirements while remaining scalable as staff change?

Accepted Answer

Implement role-based access control (RBAC) with least privilege, assigning permissions to job-function roles that users inherit

Answer

Grant each analyst individual permissions on every table and column as they are hired

Answer

Give all analysts read access to the full warehouse and rely on a written policy telling them which fields to avoid

Answer

Export separate spreadsheets for each analyst containing only their approved columns