Firstly, I have never been involved in information system design and so I have no experience in not being able to preserve the CIA as well. But let me share one experience that may nearly impact information confidentiality. I was once experienced working as a clinical research monitor and needed to access the EMR system at the clinical site to monitor the subject’s clinical history. However, this site did not request access for external users. Therefore, I need to use the study coordinator’s access to the EMR system with an over-the-shoulder method. This should be prevented by requesting CRA’s access at least 1 month before the visit. It is good that this site has access control of different levels to ensure that the user can get the right information without accidental access to any sensitive information.