IT companies often use access keys, credentials, and remote management software to maintain their client's infrastructure. These access methods are then saved in some form of database so that the IT technicians can look up how to log into each client's system when it needs work. These IT companies themselves are not storing their client's data, but their database contains information that could be used to grant full access to a client's data.
Do these databases need to meet the legal security requirements of the systems that they could be used to gain access to such as a server containing medical records (HIPPA) or financial information (PCI)?