Compartmentalize access

Block access to medical data of patients that don't go to users' site (difficulty: some sites will share clients, so it can't be compartmentalized only by site)
- demographics info = OK
- calendar? = don't want physicians to see other clinics' schedules