To what extent are you sharing consultation records for patients with musculoskeletal symptoms?

Hello, I am in charge of health management.
When consulting on musculoskeletal symptoms, the details of the consultation, findings from the work environment, and necessary work adjustments are recorded together.
It's a bit difficult to set a standard for how much of this I should actually share.
It seems like the health manager or health agent needs to verify this, but it is unclear to what extent HR or field managers should review the details.
In particular, I don't think it is appropriate to show the original records, which include details such as hospital usage history and personal counseling content, exactly as they are to the department head.
Also, if you want to adjust work hours or methods, you have to convey the details to the site to some extent, don't you?
Do you usually manage the original consultation records and the information delivered to the field separately?
I am curious to know to what extent HR or field managers are allowed to verify information, and whether you keep separate records of revoking existing access rights when the person in charge changes or leaves the company.
If anyone is running a similar operation, I would appreciate it if you could let me know how you manage it.