Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #14307 > unrolled thread

getting started with encryption

Back to article view | Back to comp.lang.php

Contents

  getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
    Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
    Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
    Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
        Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
          Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
            Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
              Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
                  Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
                    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
                    Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
                      Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
                  Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
                    How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
                      Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
                      Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
                        Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
                      Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
                  Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
                    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
                      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
                        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
                          Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
                            Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
          Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
            Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
              Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
                  Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
                    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
                      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
                        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
                    Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
                    Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
                      Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
                        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
                      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
                        Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
                          Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
    Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400

Page 1 of 3  [1] 2 3  Next page →

#14307 — getting started with encryption

It has been decided that encrypting patient notes would be a good 
idea.  I anticipated this when I wrote the original code and all 
patient note writes go through a null (now) function and all 
notes to be read, likewise.

My preliminary understanding is that I should use mcrypt. 
phpMyAdmin says "The mcrypt extension is missing. Please check 
your PHP configuration."

apt-get upgrade php5-mcrypt says it is installed and up to date.
phpinfo() has no mention of mcrypt.


I would welcome any comments about mcrypt and/or how to get it 
installed if it is not.

Thanks in advance
-bill

[toc] | [next] | [standalone]

#14308

bill <william@TechServSys.com> writes:

> It has been decided that encrypting patient notes would be a good
> idea.  I anticipated this when I wrote the original code and all
> patient note writes go through a null (now) function and all notes to
> be read, likewise.
>
> My preliminary understanding is that I should use mcrypt. phpMyAdmin
> says "The mcrypt extension is missing. Please check your PHP
> configuration."
>
> apt-get upgrade php5-mcrypt says it is installed and up to date.
> phpinfo() has no mention of mcrypt.
>
>
> I would welcome any comments about mcrypt and/or how to get it
> installed if it is not.
>
> Thanks in advance
> -bill

Hi Bill,

On Arch Linux I have to add the following line to php.ini:

     extension=mcrypt.so


-- 
Matthew Carter (m@ahungry.com)
http://ahungry.com

[toc] | [prev] | [next] | [standalone]

#14310

On 10/10/14 02:46 PM, bill wrote:
>
> My preliminary understanding is that I should use mcrypt. phpMyAdmin
> says "The mcrypt extension is missing. Please check your PHP
> configuration."
>
> apt-get upgrade php5-mcrypt says it is installed and up to date.
> phpinfo() has no mention of mcrypt.

Since you're using apt-get, I assume you're using Debian or a 
derivative.  So you've installed the necessary files but not configured 
PHP to use it.  Run (as root):

php5enmod mcrypt

Then restart Apache.  That should enable the PHP extension.

If you're not running a Debian derivative, then you'll probably have to 
edit php.ini as another poster has suggested.

[toc] | [prev] | [next] | [standalone]

#14311

On 10/10/14 20:46, bill wrote:
> It has been decided that encrypting patient notes would be a good idea.
> I anticipated this when I wrote the original code and all patient note
> writes go through a null (now) function and all notes to be read, likewise.

Most systems with patient data use encrypted columns or encrypted fields 
where you use key management system to decide which database user has 
access to the data.

MySQL do not support this, so you need to build in something, not just 
the encryption/decryption functionality, but also access right system or 
key management system which limits who can and can't access the data.

If you want to do it on database level, then you need to look at 
PostgreSQL or going with some commercial database like Cache from 
InterSystems (maybe the worlds most used database for health-care systems).


If your system will include card payments, then you will get deep into 
troubles with the new PCI DSS 3.0.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#14315

On 10/11/2014 3:07 AM, J.O. Aho wrote:
> On 10/10/14 20:46, bill wrote:
>> It has been decided that encrypting patient notes would be a
>> good idea.
>> I anticipated this when I wrote the original code and all
>> patient note
>> writes go through a null (now) function and all notes to be
>> read, likewise.
>
> Most systems with patient data use encrypted columns or encrypted
> fields where you use key management system to decide which
> database user has access to the data.

we already have that.  Now we are protecting against data breaches.
>
>
>
> If your system will include card payments, then you will get deep
> into troubles with the new PCI DSS 3.0.
>
luckily, no credit card payments.
-bill

Thanks to John-Paul and Mathew.

-bill

[toc] | [prev] | [next] | [standalone]

#14317

On 10/10/2014 2:46 PM, bill wrote:
> It has been decided that encrypting patient notes would be a good idea. 
> I anticipated this when I wrote the original code and all patient note
> writes go through a null (now) function and all notes to be read, likewise.
> 
> My preliminary understanding is that I should use mcrypt. phpMyAdmin
> says "The mcrypt extension is missing. Please check your PHP
> configuration."
> 
> apt-get upgrade php5-mcrypt says it is installed and up to date.
> phpinfo() has no mention of mcrypt.
> 
> 
> I would welcome any comments about mcrypt and/or how to get it installed
> if it is not.
> 
> Thanks in advance
> -bill

Bill,

If you are in the United States and dealing with patient medical data of
any kind, you need to understand and follow HIPAA.  Having someone HIPAA
certified is the best.  Failure and result in six or seven figure fines.

For instance, all patient data MUST be secured.  This doesn't mean just
encrypting it in the database; it means the data must also be secured
from any break-in, including physical theft of the system itself.  You
can't, for instance, have the decryption password readable, even if it
is in a script.  You also have to restrict who physically has access to
the information server.

The Feds are cracking down on HIPAA compliance; it's good you are
encrypting the data.  Just make sure you do it right.

J.O.'s suggestion of doing it at the database level is a good on.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14318

On 10/11/2014 10:36 AM, Jerry Stuckle wrote:
> If you are in the United States and dealing with patient medical data of
> any kind, you need to understand and follow HIPAA.  Having someone HIPAA
> certified is the best.  Failure and result in six or seven figure fines.
>
> For instance, all patient data MUST be secured.  This doesn't mean just
> encrypting it in the database; it means the data must also be secured
> from any break-in, including physical theft of the system itself.  You
> can't, for instance, have the decryption password readable, even if it
> is in a script.  You also have to restrict who physically has access to
> the information server.
>
> The Feds are cracking down on HIPAA compliance; it's good you are
> encrypting the data.  Just make sure you do it right.
>
> J.O.'s suggestion of doing it at the database level is a good on.
We have addressed physical security and have good access 
controls, now we are moving on to worst case stuff - if the 
server is stolen.
Decryption password will have to be entered at each user login 
and disappears when the session ends or when the user is auto 
loged out after 3 hours of inactivity.

Thanks for the comments.

-bill

[toc] | [prev] | [next] | [standalone]

#14319

On 10/11/2014 10:42 AM, bill wrote:

> We have addressed physical security and have good access
> controls, now we are moving on to worst case stuff - if the
> server is stolen.
> Decryption password will have to be entered at each user login
> and disappears when the session ends or when the user is auto
> loged out after 3 hours of inactivity.
>
> Thanks for the comments.
>
> -bill
>
>
by access controls I meant software access:
password
pass pictures

4 levels of permission for each module per person.
bill

[toc] | [prev] | [next] | [standalone]

#14320

On 11/10/14 16:42, bill wrote:
> On 10/11/2014 10:36 AM, Jerry Stuckle wrote:
>> If you are in the United States and dealing with patient medical data of
>> any kind, you need to understand and follow HIPAA.  Having someone HIPAA
>> certified is the best.  Failure and result in six or seven figure fines.
>>
>> For instance, all patient data MUST be secured.  This doesn't mean just
>> encrypting it in the database; it means the data must also be secured
>> from any break-in, including physical theft of the system itself.  You
>> can't, for instance, have the decryption password readable, even if it
>> is in a script.  You also have to restrict who physically has access to
>> the information server.
>>
>> The Feds are cracking down on HIPAA compliance; it's good you are
>> encrypting the data.  Just make sure you do it right.
>>
>> J.O.'s suggestion of doing it at the database level is a good on.
> We have addressed physical security and have good access controls, now
> we are moving on to worst case stuff - if the server is stolen.

Session data stored in persistent storage will give the unauthorized 3rd 
party all they may need to decrypt the database. A brute force attack 
will be a lot simpler when just need to figure out a string.


> Decryption password will have to be entered at each user login and
> disappears when the session ends or when the user is auto loged out
> after 3 hours of inactivity.

3 hours inactivity is far too long.

Having the encryption/decryption key in memory for that long time will 
just make it easy to get hold of it for unauthorized 3rp party access.


If you haven't, I suggest you take a look at Cornucopia,
https://www.owasp.org/index.php/OWASP_Cornucopia

quite useful game to figure out what vulnerabilities you may have. This 
covers more than just the OWASP top 10.


-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#14321

On 10/11/2014 12:38 PM, J.O. Aho wrote:
> On 11/10/14 16:42, bill wrote:
>> On 10/11/2014 10:36 AM, Jerry Stuckle wrote:
>>> If you are in the United States and dealing with patient medical data of
>>> any kind, you need to understand and follow HIPAA.  Having someone HIPAA
>>> certified is the best.  Failure and result in six or seven figure fines.
>>>
>>> For instance, all patient data MUST be secured.  This doesn't mean just
>>> encrypting it in the database; it means the data must also be secured
>>> from any break-in, including physical theft of the system itself.  You
>>> can't, for instance, have the decryption password readable, even if it
>>> is in a script.  You also have to restrict who physically has access to
>>> the information server.
>>>
>>> The Feds are cracking down on HIPAA compliance; it's good you are
>>> encrypting the data.  Just make sure you do it right.
>>>
>>> J.O.'s suggestion of doing it at the database level is a good on.
>> We have addressed physical security and have good access controls, now
>> we are moving on to worst case stuff - if the server is stolen.
> 
> Session data stored in persistent storage will give the unauthorized 3rd
> party all they may need to decrypt the database. A brute force attack
> will be a lot simpler when just need to figure out a string.
> 
> 
>> Decryption password will have to be entered at each user login and
>> disappears when the session ends or when the user is auto loged out
>> after 3 hours of inactivity.
> 
> 3 hours inactivity is far too long.
> 
> Having the encryption/decryption key in memory for that long time will
> just make it easy to get hold of it for unauthorized 3rp party access.
> 

Very definitely.  I can see all kinds of holes in their system.  He is
leaving them wide open to a HIPAA fine.

> 
> If you haven't, I suggest you take a look at Cornucopia,
> https://www.owasp.org/index.php/OWASP_Cornucopia
> 
> quite useful game to figure out what vulnerabilities you may have. This
> covers more than just the OWASP top 10.
> 
> 

I hadn't seen this one before, J.O.  Looks like an interesting game.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14322

On 11/10/14 21:16, Jerry Stuckle wrote:
> On 10/11/2014 12:38 PM, J.O. Aho wrote:
>> On 11/10/14 16:42, bill wrote:
>>> On 10/11/2014 10:36 AM, Jerry Stuckle wrote:
>>>> If you are in the United States and dealing with patient medical data of
>>>> any kind, you need to understand and follow HIPAA.  Having someone HIPAA
>>>> certified is the best.  Failure and result in six or seven figure fines.
>>>>
>>>> For instance, all patient data MUST be secured.  This doesn't mean just
>>>> encrypting it in the database; it means the data must also be secured
>>>> from any break-in, including physical theft of the system itself.  You
>>>> can't, for instance, have the decryption password readable, even if it
>>>> is in a script.  You also have to restrict who physically has access to
>>>> the information server.
>>>>
>>>> The Feds are cracking down on HIPAA compliance; it's good you are
>>>> encrypting the data.  Just make sure you do it right.
>>>>
>>>> J.O.'s suggestion of doing it at the database level is a good on.
>>> We have addressed physical security and have good access controls, now
>>> we are moving on to worst case stuff - if the server is stolen.
>>
>> Session data stored in persistent storage will give the unauthorized 3rd
>> party all they may need to decrypt the database. A brute force attack
>> will be a lot simpler when just need to figure out a string.
>>
>>
>>> Decryption password will have to be entered at each user login and
>>> disappears when the session ends or when the user is auto loged out
>>> after 3 hours of inactivity.
>>
>> 3 hours inactivity is far too long.
>>
>> Having the encryption/decryption key in memory for that long time will
>> just make it easy to get hold of it for unauthorized 3rp party access.
>>
>
> Very definitely.  I can see all kinds of holes in their system.  He is
> leaving them wide open to a HIPAA fine.

I just pity his customer, who will suffer quite a lot of this and it 
seems they have not got the best service, a lot of   to place 
elements, meta refresh to redirect to the new wordpress page (looks 
cheap when you get to see the old page before the wordpress page loads, 
which seems to have some misconfiguration).


>> If you haven't, I suggest you take a look at Cornucopia,
>> https://www.owasp.org/index.php/OWASP_Cornucopia
>>
>> quite useful game to figure out what vulnerabilities you may have. This
>> covers more than just the OWASP top 10.
>>
> I hadn't seen this one before, J.O.  Looks like an interesting game.

It's somewhat new for me, got a on cards printed deck from the London 
chapter leader Justin Clarke, really nice guy.
We test played it on a fictive project, and sure you start to think how 
things can go wrong. The recommended group size is 4 people from 
different backgrounds, like Developer, CSO, Business.


-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#14324

>
> I just pity his customer, who will suffer quite a lot of this and
> it seems they have not got the best service, a lot of   to
> place elements, meta refresh to redirect to the new wordpress
> page (looks cheap when you get to see the old page before the
> wordpress page loads, which seems to have some misconfiguration).
>
>
Before you jump all over me you should know:
     I didn't code nor do I maintain the public website.  That 
was coded by one of the docs who loves WordPress.
     The site about which I am speaking has no public presence on 
the internet.
     The docs are psychiatrists and can spend 2 hr blocks with 
patients and refuse to sign on every time.  This seems reasonable 
as they are in the room with the client (human and computer) most 
of the time, and when they are not, physical access is protected 
by staff.

The LAN is behind a firewall, but it is still theoretically 
possible to have an intrusion so we are going to increase 
security somewhat.

good enough ?

BTW, despite gratuitous attacks, I still very much appreciate the 
assistance I get here.

-bill

[toc] | [prev] | [next] | [standalone]

#14325

On 10/12/2014 8:17 AM, bill wrote:
> 
>>
>> I just pity his customer, who will suffer quite a lot of this and
>> it seems they have not got the best service, a lot of   to
>> place elements, meta refresh to redirect to the new wordpress
>> page (looks cheap when you get to see the old page before the
>> wordpress page loads, which seems to have some misconfiguration).
>>
>>
> Before you jump all over me you should know:
>     I didn't code nor do I maintain the public website.  That was coded
> by one of the docs who loves WordPress.
>     The site about which I am speaking has no public presence on the
> internet.
>     The docs are psychiatrists and can spend 2 hr blocks with patients
> and refuse to sign on every time.  This seems reasonable as they are in
> the room with the client (human and computer) most of the time, and when
> they are not, physical access is protected by staff.
> 
> The LAN is behind a firewall, but it is still theoretically possible to
> have an intrusion so we are going to increase security somewhat.
> 
> good enough ?
> 
> BTW, despite gratuitous attacks, I still very much appreciate the
> assistance I get here.
> 
> -bill
> 

No, it is not good enough.  You REALLY need to get someone who is HIPAA
certified and understands HIPAA involved (just being certified doesn't
mean all that much - but it is a step in the right direction).
Otherwise both you and the doctors could end up with VERY hefty (as in
six figure or more) fines.  It can and does happen - unfortunately, with
a fair amount of regularity.

If you can afford such a penalty, fine.  Keep going like you are.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14330

On 10/12/2014 8:47 AM, Jerry Stuckle wrote:
> On 10/12/2014 8:17 AM, bill wrote:
>>
>>>
>>> I just pity his customer, who will suffer quite a lot of this and
>>> it seems they have not got the best service, a lot of   to
>>> place elements, meta refresh to redirect to the new wordpress
>>> page (looks cheap when you get to see the old page before the
>>> wordpress page loads, which seems to have some misconfiguration).
>>>
>>>
>> Before you jump all over me you should know:
>>      I didn't code nor do I maintain the public website.  That was coded
>> by one of the docs who loves WordPress.
>>      The site about which I am speaking has no public presence on the
>> internet.
>>      The docs are psychiatrists and can spend 2 hr blocks with patients
>> and refuse to sign on every time.  This seems reasonable as they are in
>> the room with the client (human and computer) most of the time, and when
>> they are not, physical access is protected by staff.
>>
>> The LAN is behind a firewall, but it is still theoretically possible to
>> have an intrusion so we are going to increase security somewhat.
>>
>> good enough ?
>>
>> BTW, despite gratuitous attacks, I still very much appreciate the
>> assistance I get here.
>>
>> -bill
>>
>
> No, it is not good enough.  You REALLY need to get someone who is HIPAA
> certified and understands HIPAA involved (just being certified doesn't
> mean all that much - but it is a step in the right direction).
> Otherwise both you and the doctors could end up with VERY hefty (as in
> six figure or more) fines.  It can and does happen - unfortunately, with
> a fair amount of regularity.
>
> If you can afford such a penalty, fine.  Keep going like you are.
>

Thanks Jerry
The chances of a 3 doc company hiring a certified consultant are 
not large, but a good recommendation.  I live, eat, and sleep 
HIPAA (a major part of my job).
-bill

[toc] | [prev] | [next] | [standalone]

#14332

On 10/12/2014 11:04 AM, bill wrote:
> On 10/12/2014 8:47 AM, Jerry Stuckle wrote:
>> On 10/12/2014 8:17 AM, bill wrote:
>>>
>>>>
>>>> I just pity his customer, who will suffer quite a lot of this and
>>>> it seems they have not got the best service, a lot of   to
>>>> place elements, meta refresh to redirect to the new wordpress
>>>> page (looks cheap when you get to see the old page before the
>>>> wordpress page loads, which seems to have some misconfiguration).
>>>>
>>>>
>>> Before you jump all over me you should know:
>>>      I didn't code nor do I maintain the public website.  That was coded
>>> by one of the docs who loves WordPress.
>>>      The site about which I am speaking has no public presence on the
>>> internet.
>>>      The docs are psychiatrists and can spend 2 hr blocks with patients
>>> and refuse to sign on every time.  This seems reasonable as they are in
>>> the room with the client (human and computer) most of the time, and when
>>> they are not, physical access is protected by staff.
>>>
>>> The LAN is behind a firewall, but it is still theoretically possible to
>>> have an intrusion so we are going to increase security somewhat.
>>>
>>> good enough ?
>>>
>>> BTW, despite gratuitous attacks, I still very much appreciate the
>>> assistance I get here.
>>>
>>> -bill
>>>
>>
>> No, it is not good enough.  You REALLY need to get someone who is HIPAA
>> certified and understands HIPAA involved (just being certified doesn't
>> mean all that much - but it is a step in the right direction).
>> Otherwise both you and the doctors could end up with VERY hefty (as in
>> six figure or more) fines.  It can and does happen - unfortunately, with
>> a fair amount of regularity.
>>
>> If you can afford such a penalty, fine.  Keep going like you are.
>>
> 
> Thanks Jerry
> The chances of a 3 doc company hiring a certified consultant are not
> large, but a good recommendation.  I live, eat, and sleep HIPAA (a major
> part of my job).
> -bill

That may be - but you have huge security holes in your proposal.  A
HIPAA audit will result in large fines, to both you and your client.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14340

In article <m1e59p$7d2$1@speranza.aioe.org>, william@TechServSys.com 
says...
> 
> On 10/12/2014 8:47 AM, Jerry Stuckle wrote:
> > On 10/12/2014 8:17 AM, bill wrote:
> >>
> >>>
> >>> I just pity his customer, who will suffer quite a lot of this and
> >>> it seems they have not got the best service, a lot of &nbsp; to
> >>> place elements, meta refresh to redirect to the new wordpress
> >>> page (looks cheap when you get to see the old page before the
> >>> wordpress page loads, which seems to have some misconfiguration).
> >>>
> >>>
> >> Before you jump all over me you should know:
> >>      I didn't code nor do I maintain the public website.  That was coded
> >> by one of the docs who loves WordPress.
> >>      The site about which I am speaking has no public presence on the
> >> internet.
> >>      The docs are psychiatrists and can spend 2 hr blocks with patients
> >> and refuse to sign on every time.  This seems reasonable as they are in
> >> the room with the client (human and computer) most of the time, and when
> >> they are not, physical access is protected by staff.
> >>
> >> The LAN is behind a firewall, but it is still theoretically possible to
> >> have an intrusion so we are going to increase security somewhat.
> >>
> >> good enough ?
> >>
> >> BTW, despite gratuitous attacks, I still very much appreciate the
> >> assistance I get here.
> >>
> >> -bill
> >>
> >
> > No, it is not good enough.  You REALLY need to get someone who is HIPAA
> > certified and understands HIPAA involved (just being certified doesn't
> > mean all that much - but it is a step in the right direction).
> > Otherwise both you and the doctors could end up with VERY hefty (as in
> > six figure or more) fines.  It can and does happen - unfortunately, with
> > a fair amount of regularity.
> >
> > If you can afford such a penalty, fine.  Keep going like you are.
> >
> 
> Thanks Jerry
> The chances of a 3 doc company hiring a certified consultant are 
> not large, but a good recommendation.  I live, eat, and sleep 
> HIPAA (a major part of my job).
> -bill

Have you considered just licensing a certified Electronic Health Record 
system rather than rolling your own?

[toc] | [prev] | [next] | [standalone]

#14341

On 10/12/2014 3:12 PM, J. Clarke wrote:
> In article <m1e59p$7d2$1@speranza.aioe.org>, william@TechServSys.com 
> says...
>>
>> On 10/12/2014 8:47 AM, Jerry Stuckle wrote:
>>> On 10/12/2014 8:17 AM, bill wrote:
>>>>
>>>>>
>>>>> I just pity his customer, who will suffer quite a lot of this and
>>>>> it seems they have not got the best service, a lot of &nbsp; to
>>>>> place elements, meta refresh to redirect to the new wordpress
>>>>> page (looks cheap when you get to see the old page before the
>>>>> wordpress page loads, which seems to have some misconfiguration).
>>>>>
>>>>>
>>>> Before you jump all over me you should know:
>>>>      I didn't code nor do I maintain the public website.  That was coded
>>>> by one of the docs who loves WordPress.
>>>>      The site about which I am speaking has no public presence on the
>>>> internet.
>>>>      The docs are psychiatrists and can spend 2 hr blocks with patients
>>>> and refuse to sign on every time.  This seems reasonable as they are in
>>>> the room with the client (human and computer) most of the time, and when
>>>> they are not, physical access is protected by staff.
>>>>
>>>> The LAN is behind a firewall, but it is still theoretically possible to
>>>> have an intrusion so we are going to increase security somewhat.
>>>>
>>>> good enough ?
>>>>
>>>> BTW, despite gratuitous attacks, I still very much appreciate the
>>>> assistance I get here.
>>>>
>>>> -bill
>>>>
>>>
>>> No, it is not good enough.  You REALLY need to get someone who is HIPAA
>>> certified and understands HIPAA involved (just being certified doesn't
>>> mean all that much - but it is a step in the right direction).
>>> Otherwise both you and the doctors could end up with VERY hefty (as in
>>> six figure or more) fines.  It can and does happen - unfortunately, with
>>> a fair amount of regularity.
>>>
>>> If you can afford such a penalty, fine.  Keep going like you are.
>>>
>>
>> Thanks Jerry
>> The chances of a 3 doc company hiring a certified consultant are 
>> not large, but a good recommendation.  I live, eat, and sleep 
>> HIPAA (a major part of my job).
>> -bill
> 
> Have you considered just licensing a certified Electronic Health Record 
> system rather than rolling your own?
> 

That would be a much better solution.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14327

On 12/10/14 14:17, bill wrote:
>
>>
>> I just pity his customer, who will suffer quite a lot of this and
>> it seems they have not got the best service, a lot of   to
>> place elements, meta refresh to redirect to the new wordpress
>> page (looks cheap when you get to see the old page before the
>> wordpress page loads, which seems to have some misconfiguration).
>>
>>
> Before you jump all over me you should know:
>      I didn't code nor do I maintain the public website.  That was coded
> by one of the docs who loves WordPress.

Your own homepage written by one of your customers?

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#14328

On 10/12/2014 9:53 AM, J.O. Aho wrote:
> On 12/10/14 14:17, bill wrote:
>>
>>>
>>> I just pity his customer, who will suffer quite a lot of this and
>>> it seems they have not got the best service, a lot of   to
>>> place elements, meta refresh to redirect to the new wordpress
>>> page (looks cheap when you get to see the old page before the
>>> wordpress page loads, which seems to have some misconfiguration).
>>>
>>>
>> Before you jump all over me you should know:
>>      I didn't code nor do I maintain the public website.  That was coded
>> by one of the docs who loves WordPress.
> 
> Your own homepage written by one of your customers?
> 

I hadn't looked at his home page before you mentioned it.  But now I see
what you mean.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#14331 — How - off topic

On 10/12/2014 10:07 AM, Jerry Stuckle wrote:
> On 10/12/2014 9:53 AM, J.O. Aho wrote:
>> On 12/10/14 14:17, bill wrote:
>>>
>>>>
>>>> I just pity his customer, who will suffer quite a lot of this and
>>>> it seems they have not got the best service, a lot of   to
>>>> place elements, meta refresh to redirect to the new wordpress
>>>> page (looks cheap when you get to see the old page before the
>>>> wordpress page loads, which seems to have some misconfiguration).
>>>>
>>>>
>>> Before you jump all over me you should know:
>>>       I didn't code nor do I maintain the public website.  That was coded
>>> by one of the docs who loves WordPress.
>>
>> Your own homepage written by one of your customers?
>>
>
> I hadn't looked at his home page before you mentioned it.  But now I see
> what you mean.
>

as a matter of interest: How did you guys get from my email 
address to the public website?  I know how to get from domain to 
registrant but not the other way.

-bill

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.lang.php

csiph-web