file upload user profile

If this is a medical record, you probably so use a transient download URL for the session when the profile is logged on, and destroy that URL when the users logs off, this ensures that the file is not accessible to others.

I used WP Customer Area plugin on a CRM project and found it extremely useful for this kind of problem. You can create a secure page for customer, and secure file attachments in the dashboard which only the profile can access.