Mechanisms exist to restrict the disclosure of sensitive / regulated data to authorized parties with a need to know.
Does the organization restrict the disclosure of sensitive / regulated data to authorized parties with a need to know?