Online and onsite data typically employs a central 'vault' to store staff and patients' data, in a common/shared repository.
This 'vault' is governed by its owners and stakeholders. Whoever that happens to be at any time.
Unless you're a 'sovereign state' or 'corporate interest' with a wedge invested in this 'vault'. Because.