Can we limit what each staff member can see and do?

Access should follow the job. The front desk needs scheduling and billing functions and usually does not need clinical records, financial reporting, or the ability to change system settings. Clinical staff need patient records and usually do not need payroll or banking. Whoever handles money needs the accounting system and usually does not need administrative control of the network.

We map roles to what each group actually does during onboarding and then apply it at both layers: in your systems and files, and inside your line of business application where it supports roles. It is rarely as disruptive as owners fear, because most people only use what their job requires anyway. The objections come from a handful of long-tenured staff who have accumulated access over the years.

The reason it matters is not that you distrust your team. It is that one compromised account should not expose everything you hold. Attackers rely on the account they get into being able to reach far more than that person's job required, and that is almost always true in a business that never did this exercise.