This is big, east coast, many-contractor design. By the time things made it to the point that somebody was thinking about security, a rule like "providers will be given access to the following fields for a client upon request" was likely already written into a half dozen contracts between seventeen sub-contractors.