Revoking access to Disability REST API

Summary:

Revoking access to Disability REST API

Content (required):

We are creating a role which enables the line manager to access employment details of their subordinates. We added the privilege Use REST Service - Workers Read Only so that he would be able to call for the GET method associated with Workers REST APIs. We specified with data security policies which tables the role should be able to access.

Unfortunately users with this role can also access disability information of the employees via the REST APIs. Had anybody else a similar issue and could advise how to limit the visibility of disability information?