We might be starting a new project at work for a doctors surgery. But because the database will contain information such as patient notes etc. I'm worried about security.
Is it sufficiently secure to store sensitive information like this as plain text in a MySQL database? Or should we look at encrypting it in some way, bearing in mind some of the notes may be quite long.
I would imagine that the partners at the surgery will demand encryption. It's worth bearing in a mind though that both Emis on the GP side and ISoft PAS on the hospital side all store their patient data unencyrpted, just with multiple levels of security in front of it.
Most of the emis practices in this region for example use a username/password combo then the choose & book smartcards and pin numbers as an additional protection level.
It would also be worth checking if the government has guidelines about storing patient data. It sounds like something they would have published a paper on
Thanks for the replies, I'll check out those links Alan :)
The weird thing is, we've been asked to have a look at their current system so that we can add some more functionality to it and it seems seriously insecure, passwords aren't encrypted, the db is stored on a cheap host and the app seems to include half the files from osCommerce .
It really is a disgrace, we're going to advise them that the whole thing is unusable and should be scrapped so I want to make sure we can tell them exactly why they shouldn't use it.