In an access controller and method for controlling access to medical data, the medical data being provided as at least one first file and a second file independent of the first file with findings regarding patients that are generated by medical personnel being stored in the first file and measurement results of patients that were acquired by means of a medical-technical apparatus being stored in the second file, with at least one subset of the measurement results stored in the second file forming the basis of at least a subset of the findings stored in the first file, the access controller is configured to detect the measurement results forming the basis of a stored finding. Links to the measurement results forming the basis of a respective finding are stored at the findings in the first file and the access controller is configured to automatically detect measurement results stored in the second file and form the basis of a finding, the automatic detection ensuing using the link stored at the respective finding in the first file.