I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing access to this data in a database? Should developers be allowed unfettered access to the entire database, since it is part of their job, or are there measures to be taken to obscure or change data?
Short answer: No, developers should not be allowed acces to PHI. But in order to let them work in an environment which correctly mirrors the real world, many do!
One of the options I used to see where the organisation had the capability was to provide developers with a sanitised copy of the live database.
Obviously this takes some resource
- you need a real development environment, not just one with pointers to a live database
- sanitisation is resource heavy and time consuming
- change management around the development and production environments and code promotion becomes critical
Just thought I'd update to give a little more info around sanitisation. For sensitive information this really means removing identifying information. I have seen this done by completing a full replace of names and account numbers by random (but unique) ones, or by carrying out a swap of data, so the names are no longer connected to the addresses and medical details which they started with. This is hard work - especially as you usually have to ensure the age and sex of each individual is appropriate (especially for medical databases) otherwise testing may get tricky (eg trying to track down use cases for a pregnant 90 year old man)
If your dev needs aren't as in depth, you could just provide a small database with made up data - much simpler, but not as close to real world conditions.