What might work against us is some of the time safeguards built into CCHITT. This would support autolock of the program after 10-15 minutes, which is built into the regulations. Another regulation would require changing passwords every 90 days. Hassles that few of us would like to endure.
On the plus side, it could be argued that the ability of companies to log into our data could create a breach that could be exploited.
On the broader conceptual scale, I have no quarrels with the position paper.
