Charlotte Foust
cfoust at infostatsystems.com
Mon Apr 9 10:06:49 CDT 2007
Charlotte has done NO HIPPA work and is eternally grateful for that same miracle! Charlotte -----Original Message----- From: accessd-bounces at databaseadvisors.com [mailto:accessd-bounces at databaseadvisors.com] On Behalf Of MartyConnelly Sent: Saturday, April 07, 2007 10:17 AM To: Access Developers discussion and problem solving Subject: Re: [AccessD] New database design for MS SQL Two tier authentication with a USB Fob is supposed to verify the guy with the password and the USB token are the same. In other words the password hasn't been loaned out. The token alone won't get you in. There are $5 USB tokens on the market now but may require some server hardware possibly in 2K to 5K dollar range. Until this year the price was around $60. Here are some cheap Canadian examples. http://www.itbusiness.ca/it/client/en/home/News.asp?id=41998 I have been looking for a case study where someone has hooked this into Sharepoint sites. The vendors might be able to provide it. Some continental European banks have been doing client web app with USB tokens (even at an 60 Euro cost) for a couple of years. Charlotte may have done some HIPPA work. Aside from this there has to be a lot of data encryption. Jim Dettman wrote: >Marty, > > Yes, one of my big concerns with this app is security. That's also >why I'm approaching their requirement of possible web access with some >hesitation. If there will not be a web interface, then the allure of >doing a 3-tier design becomes a lot less. > > The main app is going to be using SQL Server for the BE, so it will >be tight and access to the system will be through Terminal Services. >It's the web thing that worries me, although that's not in the scope as yet. > > In the states, we need to deal with the HIPAA (Health Insurance >Portability and Accountability Act), which I need to get some info on, >as I'm not sure how far I need to go with security. I'm assuming the >worst at this point<g>. > >Jim. > >-----Original Message----- >From: accessd-bounces at databaseadvisors.com >[mailto:accessd-bounces at databaseadvisors.com] On Behalf Of >MartyConnelly >Sent: Friday, April 06, 2007 8:43 PM >To: Access Developers discussion and problem solving >Subject: Re: [AccessD] New database design for MS SQL > >In Canada with Web based Apps on health and legal sites, you will have >to soon consider using two tier authentication for security to conform >with. >The Personal Information Protection and Electronic Documents Act, also >known by the awkward acronym PIPEDA, which came into full effect on >Jan. 2004. >There have been several sites in Ontario that have been compromised >when password only. >Nurses were leaving userids etc on postit notes and patients were >looking through STD reporting sites that were supposed to be doctor >only access. >So it is biometrics or dongles or USB keys (some with cyclical keys are >into the $20 range). >Forget fingerprint devices, Discovery channel showed a method to defeat >this 6 months ago. >By the way this will probably start to apply to HIPPA and European Data >Privacy Acts. >This isn't being enforced yet but will be soon. > > >Jim Dettman wrote: > > > >>Charlotte, >> >><< It offers so much more flexibility than our beloved Access can >>right now.>> >> >> That's what I've been thinking. I am worried that they are going to >>want a web interface for their nurses that are remote and possibly at >>some point give Doctors and Attorneys access to the system. >> >>Jim. >> >>-----Original Message----- >>From: accessd-bounces at databaseadvisors.com >>[mailto:accessd-bounces at databaseadvisors.com] On Behalf Of Charlotte >>Foust >>Sent: Friday, April 06, 2007 1:11 PM >>To: Access Developers discussion and problem solving >>Subject: Re: [AccessD] New database design for MS SQL >> >>I don't know VFP, but I'd say go with the full 3-tier approach. It >>offers so much more flexibility than our beloved Access can right now. >>Since Access itself is moving toward being a front end, the next >>versions may see it gain a lot of those capabilities, but for now they >>aren't there. The .Net framework hasn't yet found its way into Access. >> >>Charlotte Foust >> >> -- Marty Connelly Victoria, B.C. Canada -- AccessD mailing list AccessD at databaseadvisors.com http://databaseadvisors.com/mailman/listinfo/accessd Website: http://www.databaseadvisors.com