Access is governed by role-based access controls, and all viewing activity is logged for audit and compliance purposes.