I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement.
Most computers will most likely have no internet access, except for doing scheduled updates (checking Windows Updates, etc).
The data will be stored most likely in a MySQL database that is stored on a dedicated Ubuntu computer. I am considering setting up a backup system of 2 external portable hard drives to do daily database backups and switched periodically (weekly/monthly/etc) with the hard drive that is stored in a safe deposit box.
There will probably be approximately 3 laptops purchased for doctors/nurses to use and most likely an android tablet for patients to fill out medical forms and sign forms.
At this time we are not planning to offer patients access to their medical records online. All access to the database would be done on the LAN. I am thinking of setting up a VLAN.
I am considering creating ID badges for the staff that has an embedded NFC chip to be used for authorization to log into the database, etc.
I know I will need to encrypt the database and the external hard drives, but I have not decided which method would be the best.
One question I have been trying to decide on, is since all access is done on the LAN, would I need to use SSL connection?
I am also open for any advice/recommendations that you can offer me for this setup.