patientlist improved with access checking