|
date: Wed, 20 Aug 2008 22:01:02 -0400
from: Mike Cunningham <mcunning@xxxxxxx>
subject: RE: DB2/400 logging of read only access
True on HIPPA rules but the only way to do that would be at an
application level and if someone were to access all the same records
using DFU and construct up the patients record with cut and paste
operations you would not get that access recorded.
Since we are not covered by HIPPA I was actually thinking of
enhancing the protection of some data elements like SSN and credit
card numbers which I encrypt but would still like to be able to tell
who read any file that has any of this type of data. I was thinking
of moving this data to a file with only this data and journaling
everything that accesses it so even if someone were to gain access
(odbc, jdbc, dfu, etc, etc, etc) I know the db is recording
everything. A trigger might work fine for this since the file is not
accessed often and the overhead of the trigger processing would not
be that great. I could also do some scans against the journals
looking for activity I do not expect (ignore anything logged from
one of our applications that are allowed to use the data) and send
myself an alert
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.