As Microsoft-hesitant as I am, Office 365 handles this use case well, bundling a lot of additional functionality into their subscriptions (Email, Office, etc.) that decreases the administrative load on a small business. SharePoint with a well-maintained access control list would cover what you mentioned.

If you have truly sensitive information and/or regulations involved, you can layer RMS (Microsoft's DRM solution, could be additional purchase depending on subscription level) on top of SharePoint and get document-level encryption that follows files around and enforces your ACLs elsewhere. It uses your identity instead of a per-document password, which is a nicer UX.