Your confidentiality policy should address how MSPs obtain approvals and recommendations. If a department chair or other committee member can't come to the medical staff services office to review the files, do not simply drop the files off, unattended, at their office.