I was on the back-end of a large electronic health records implementation. I'm not actually sure better care resulted, and the security was that dystopian type, ridiculous and insecure at the same time (we had to downgrade some systems to connect).
At least in this mental health practice, you charted on paper / locally to the providers systems. We had a billing team (in old model) that only uploaded key patient info (MRN / DOB / Service date / time / billing code) to a billing system. This was done using billing slips that went to someone trained on it (who could handle all the weird hassles around eligibility etc etc).
Provider would actually talk to patients etc etc. The notes were pretty focused afterwards. And yes - pretty secure - it was actually hard to just browse around - providers locked up their notes in their office, and their office was locked (we had a three lock rule -> front door with alarm (metal gate), office locked, file drawer locked.
What people don't tell you is with the electronic health record, they also required that all these required elements be "charted" - on EVERY visit. So in new system pretty soon charts become a pages of boilerplate per visit - copy and paste stuff. It was not useful anymore to do a case history from this chart.
So we made the admin folks happy, but what a trash experience - the EHR folks are selling bills of goods and the admin folks implementing and the compliance folks mandating endless boilerplate and macro entries to get anything approved are wasting all our time and money.
I got out, never felt better - the people were great, the ordered from on high decade old java app through a double VPN that worked 50% of the time with no user experience thinking - a nightmare.
And in this new system, every sysadmin could basically snoop on anyone (all in the name of patient coordination) as could lots of others who just ended up with the extra permissions because the system was so locked down we all basically had to be superusers. To run billing reports you needed access to every record - so they had to give you these ridiculous permission levels. And to avoid QC issues billing staff are reading all the chart notes to make sure all the required boilerplate is in them. Such BS. This system was integrated with a lot of providers, so you could also see everything related to that person everywhere (all the office / admin / billing staff at literally every provider included). While a bit helpful if you had a billing issue (same unit type billed at an unapproved frequency) all the benefits focused on that type stuff (admin ease) and privacy was zero across that backend system.