Posts made by drewlander

@scottalanmiller said:

@drewlander said:

@Jason said:

You have to do a lot of tracking to determine what is normal. IPs change. People move around a lot. People use Cellular devices. Heck the actual IP address for Celluar devices will often show different states.

Good point. If a customer called me however and said they cannot access a document on a secure document exchange server from their mobile device, I would probably tell them to go to a computer. No one should be storing PHI on their cellphone.

Why is that? What if that is all that they have? Why would a medical facility get involved in determining the appropriateness of device types for customers? That seems fundamentally wrong. And what if one facility decides that only "Windows is okay" and the next that "only phones are okay" and the next says "Only Macs are secure."

We are getting into IT wanting to be in charge of everything from where customers travel, which customers are given access and from what operating systems they are allowed to access their own data.

Because I cannot be responsible for a system that keeps data secure and at the same time not have any control over how that data is accessed.

@scottalanmiller said:

@Dashrender said:

let's assume that it's provisionable/provisioned data - so what? I work for the company house/managing/maintaining the data, why can't I access it for the sake of security?

Because it is NOT your data, you DO NOT need it and it is against the law. The security to worry about here is IT getting data it does not have a right to see! The security breach here would be you.

The assumption of geo-security is an idea being pushed by IT, and to be useful would require a lot of HIPAA data that is not yours to use.

LOL! As a doctor, don't pay your hosted EMR bill then try to get YOUR data and see how that goes. I see this happen all the time. Vendors argue they cannot separate the intellectual property from the records without doing a "Conversion", which ends up costing tens of thousands depending on the system. You are basically paying an ETF for your contract because no conversion costs that much money.

This has nothing to do with ProjectSend tho. I do think the IP is good for tracking because it can show a trend or indicate unusual activity. Google does this with gmail and it works pretty well overall. If its required by HIPAA, I dont know. I doubt it specifically says you must tracking logins by IP. Chances are the legalese is much more generic like "The covered entity will make every reasonable effort to ensure only authorized users and or devices may be granted access to PHI" or something.

@scottalanmiller said:

@drewlander said:

@Dashrender said:
LOL, our current EHR company does ban access to their systems from most middle east and chinese based IPs. So yeah, they do deny you. Is it right? who am I to say?

If I was McDonald's fast food I would not Geoblock because I would be a multinational company. Athena Healthcare however... No one in Ukraine has any business making a connection so I dont see why they wouldnt block traffic from a foreign country.

And that's where it's wrong. If I am an Athena healthcare customer and travel to the Ukraine and they block me getting access to my services they are likely breaking the law. The idea that people should be blocked from things that they have the right to access because our opinion of their location is that they should not be allowed to travel there is odd. Only in the US would the idea of blocking customers because they travel come up, it's so completely an American-only mindset.

I beg to differ. If a doctor travel's out of the country and data on PHI is being sent out of the country, then chances are the doctor traveling is breaking the law. We have all sorts legalese when dealing with Canadian doctors hosted on servers in the US, to the point that its probably cheaper to get a host up in Canada. Thats just one example.

@scottalanmiller said:

@drewlander said:

I geoblock in my firewall, so I assure you any IP assigned to Japan is not making a connection to me. Therefore it is possible to know if traffic is coming from Japan. Unless of course they are going through a proxy or something.

There was another thread just today about how @Carnival-Boy's connection is showing him as France, but he is not. There is no reliable geo-location service for IPs today even when we don't VPN or proxy. As someone outside of the US, that stuff is wrong a lot of the time and people choose to appear as different countries intentionally all of the time.

Geo-location blocking is tough because it blocks the good guys and not the bad guys.

It's "best effort", not an exact science of course. I download CIDR's and update every night through scripts. Chances are this would not happen often, but with IPv6 catching on I cannot say what a good long term solution would be.

@Jason said:

You have to do a lot of tracking to determine what is normal. IPs change. People move around a lot. People use Cellular devices. Heck the actual IP address for Celluar devices will often show different states.

Good point. If a customer called me however and said they cannot access a document on a secure document exchange server from their mobile device, I would probably tell them to go to a computer. No one should be storing PHI on their cellphone.

@Dashrender said:
LOL, our current EHR company does ban access to their systems from most middle east and chinese based IPs. So yeah, they do deny you. Is it right? who am I to say?

If I was McDonald's fast food I would not Geoblock because I would be a multinational company. Athena Healthcare however... No one in Ukraine has any business making a connection so I dont see why they wouldnt block traffic from a foreign country.

@scottalanmiller said:

Things you cannot know:

• That the IP is from Japan
• That the person is not supposed to be in Japan

You know neither of these things. How do you want to react with misleading information that makes you assume one thing but doesn't mean that?

I geoblock in my firewall, so I assure you any IP assigned to Japan is not making a connection to me. Therefore it is possible to know if traffic is coming from Japan. Unless of course they are going through a proxy or something.

@scottalanmiller said:

@coliver said:

So if the user is liable for their own account why are you tracking IP addresses? You just said after you give them the information you are no longer responsible for how they access it.

I'd say tracking IPs is bad because there is nothing good that could come from storing that information.

Tracking IP's is not bad, but its not entirely reliable unless you make a reverse proxy connection.

@Dashrender said:
" it can run using its own stand-alone user database or run using LDAP / AD for the User database. "

I wouldnt want to tie it into AD except for system users. Client users (remote users) should not have accounts in my AD because thats one more thing I have to worry about.

@dafyre I havent felt out the product yet, but I did install centOS into a vm last night, then installed nethserver and owncloud to check it all out. I still like this ProjectSend open source solution though.

@scottalanmiller said:

he web logs for MangoLassi would tell us almost nothing. It would show only one connection for each tab that you have open rather than info about each page that you go to. That's why we rely on the application itself for stats. Only the app knows when it has shown a p

I noticed this right away when I came to MLIT because the views tick at each view instead of unique views.

@Reid-Cooper said:

nd want to talk

No. If I wrote this it would be written in MVC for PHP. I was looking for an open source solution, found one and feel it needs some tweaks but its a good solution overall.

@scottalanmiller , that is how I understood the ownCloud product when I read up on it.

@Dashrender said:

rpose is. A repl

I need to see exactly what they are doing with that SWF, that aside I like this solution and discussed it with Dashrender but we agreed it probably requires a few modifications.

1.) This app needs to log IP Addresses
2.) A client should be able to target a file to system user if the system user has a targeted an active file to the client.
3.) The new user email template should not include a plain text password. It should have a username and a link to the forgot password landing page so the user can request and reset their own account if their account is created by a system user.

I have no experience with ownCloud but I am not interested in creating a central point of management for dropbox and sharepoint or whatever it is they are advertising. If the state requires a patient record I need a secure file exchange service to handle that transaction, and that is specifically what this app does.

-d