As someone else mentioned, yes he does need to be able to access that data should a specific need arise.
That said, personal health records at an insurance provider are not the same thing as classified information within the DOD. The DOD classifies lots of operational details in order to protect its operations. Unit locations, security procedures, budgets, even the existence and personnel rosters of certain locations. Do you think Mark Bertolini could run Aetna without access to its complete budget, employee rolls, locations, and functional areas?