The assumption made by the server programs is that the clients are unable to do any form of role-based access control. Therefore, all access control is done by the servers.
Access control is enforced by each method in the patient record server object.
If the access check fails, no data is returned to the caller, and an error message is written into the access control block, which is returned. If the access check is successful, the query on the database is performed. Before data is returned, any data items that are not accessible to the requester are eliminated from the data. This control allows pieces of the database tables to be accessed, while other pieces are suppressed. The server method uses a table-driven approach to remove any data not accessible because of the requester's role.