adding authentication requirement before accessing patient data