Yes, this is doable, I have done this several times. One example with a HR planning form where managers were identified by their login and then only shown the data of their direct reports.
First you must identify the form user:
Method 1 use the username() function in InfoPath2007 to identify the user.
This leverages out of the box functionality if you use 2007 but does not often work via vpn and ras situations since it grabs the local account not the AD account if they do not log into the domain locally.
Method 2 use SharePoint to get the user name
This requires SharePoint, and requires some setup and two parts but once configured works fairly good. You can get the instructions here on the site.
Method 3 use a webservice such as the one included in the Database Accelerator download.Qdabra Database Accelerator Suite Version 2.0 - Developer
This is what I would recomend as it is the most universal and easiest to set up. With AD information you can pull department or manager from the existing data without having to keep that and maintain that data yourself. You also can use SQL to control permisions and access.
Once you have identified the user then you would need to have the matching username or department or name in the tables to make the match.