If my house depends on your house being sound, then yes, I should be allowed to nondestructively inspect your house form the outside or with whatever access you gave me.

This analogy has limits, but I work in the medical field. I even worked at change healthcare until last year. The consequences of PHI data breach are almost unbounded. Furthermore, If I put my reputation and that of the business on your service you better bet I will poke around with whatever access you gave me.