HIPAA Revisited (Reviving old thread 181-481897)

[evalesthy]

Probably a year has gone by and I wanted to see how others had addressed HIPAA issues with Access databases.

Issues have included: Strong Passwords, Audit Trails, ScreenBlocking or Automatic Logoff, Login Monitoring & user access control, Encryption of data.

What have you attempted to do within Access and what have you presumed is better (and sufficiently) addressed outside of Access. (e.g. is Network Logon sufficient security)

What about protecting mdb or mde files in a split database circumstance?

This can get pretty long-winded - maybe a thread for each issue would be appropriate. Anyone else have thoughts on this.

 

[evalesthy]

I'll bump this up one time given that I posted over the weekend and maybe it got limited viewing before sliding down the list.

 

[markphsd]

I think that given how easy it is to get through the access security, efforts to include an mdw would be time wasted.

Given that, have you ever been contacted by HIPPA? Have you ever heard of anyone getting infractions for breaking rules.

I think on the small database size, which is what access is, you don't have to worry too much about HIPPA.

Put the workload on the network and the security of the office.

Make strong passwords on the network, get a firewall, make the screen time out to a screen saver to prevent people who pass by from viewing data. These efforts will greatly improve many area's that need to be secured within the computer system, rather then just focusing on the Access database. Because HIPPA has been so vauge, you could apply the view that network security also applies to Access security, which it does.

Mark P.

http://www.cafecartel.com

Providing Low Cost Powerful Point of Sale Solutions.

 

[evalesthy]

Thanks for the response.

Within our applications we have implemented the following:
1. Screen timeouts
2. Failed Login Attempts
3. 'Strong' password (Upper case, lower case, special characters) that is at db level (in addition to network logon)
4. Areas of database (forms/reports) restricted based on users group

However, we have not implemented:
1. Encryption of data
2. Audit Trail
3. (what else have I failed to address?)

So, I was curious what others have done. Also, given Access' inherent limitations does it preclude its use in many HIPAA environments?

 

[markphsd]

I think that as long as you have secured the network, what's inside it is considered secure. If Access really wasn't already precluded, there would be a ton of commercial programs out there that need a lot of revamping.

Also there are several applications that use files you can open up and read, that aren't Access based. And they have passed HIPPA, or the EDI rules.

2. There is an Access Audit trail. You can look it up. I've seen it, something microsoft wrote a while ago.

1. Once again, if your network is encrypted, so is your data.

I'm not an authority on the matter though, i just call it like i see it. I've read a bit about it.. not very extensively though.

Mark P.

http://www.cafecartel.com

Providing Low Cost Powerful Point of Sale Solutions.