Virtual patient records provide a means for integrated access to patient information that may be scattered around different healthcare settings. Within the boundaries of a health district providing all levels of care, this concept can be implemented in an Intranet environment to support longitudinal patient care activities across the participating healthcare providers. Since medical information is stored on multiple Intranet sites in various forms (e.g. codified data, transcribed documents, and images), a suite of appropriate tools is needed to enable access to such information in combined form. In most cases, however, access to medical information should be restricted to authorized users. To serve this purpose, a prototype search engine incorporating an authorization and access control functionality has been developed and presented in this paper. The system is based on the signature file access method and an experimental implementation written in JAVA is also described.