0

I am looking to create a ePHI database for a small physical therapy office and I would like some advice on some of the security that I will need to implement.

Most computers will most likely have no internet access, except for doing scheduled updates (checking Windows Updates, etc).

The data will be stored most likely in a MySQL database that is stored on a dedicated Ubuntu computer. I am considering setting up a backup system of 2 external portable hard drives to do daily database backups and switched periodically (weekly/monthly/etc) with the hard drive that is stored in a safe deposit box.

There will probably be approximately 3 laptops purchased for doctors/nurses to use and most likely an android tablet for patients to fill out medical forms and sign forms.

At this time we are not planning to offer patients access to their medical records online. All access to the database would be done on the LAN. I am thinking of setting up a VLAN.

I am considering creating ID badges for the staff that has an embedded NFC chip to be used for authorization to log into the database, etc.

I know I will need to encrypt the database and the external hard drives, but I have not decided which method would be the best.

One question I have been trying to decide on, is since all access is done on the LAN, would I need to use SSL connection?

I am also open for any advice/recommendations that you can offer me for this setup.

9
  • Make sure that the laptop drives are also fully encrypted - they are potentially the weakest link in what you have described so far. Will there by any VPN access? VLAN is used to segregate traffic, what sort of "unfriendly" traffic do you wish to separate? Sep 7, 2014 at 2:43
  • Note that HIPAA doesn't prescribe any specific security measures regarding IT systems, rather it defines who may access medical data under what conditions and leaves implementation to the organization. Usually this means risk mitigation through standard security practices such as the ones you describe.
    – dartonw
    Sep 7, 2014 at 14:00
  • @user2813274: I might use VPN, I am not sure. I was thinking of using the VLAN to limit the server and possibly the laptops from exposure to the internet except for when I do updates to the system. Sep 8, 2014 at 12:47
  • @CampSoup1988 If you want to limit internet access to only for windows updates, wouldn't it make more sense to just use a whitelist on the firewall/router with this? Sep 8, 2014 at 21:31
  • @user2813274: I did not think of that. I will look into your idea. It probably would not only be for Windows Updates, but any other programs (Adobe Acrobat, Browser, etc) for both Windows and Ubuntu. I would need to get a physical firewall and a switch if any of the computers will need unrestricted internet access (secretary, etc). Correct? Sep 9, 2014 at 17:16

0

You must log in to answer this question.

Browse other questions tagged .