Health care is a complex and transnational task of societies. The various institutions and individuals involved are not and should not be governed by one central authority, but have legitimate and sometimes diverging interests. Balancing these interests has been subject to organizational and legal procedures traditionally. Today, institutions like hospitals and practices are no longer employers of isolated IT-systems, but they increasingly collaborate by means of a transnational network of various highly efficient database and datatransfer components, etc. Balancing all legitimate interests demands too much of organizational measures and, thus, requires direct support by the IT-systems themselves. The most important implication for the specification of such systems is that it must explicitly allow different parties to distrust different components of the system. We start from a simple specification of a "secure" system and unfold it with respect to typical requirements of he...