control of patient information