HIPAA Regulations

[Boris Perov]

As part of HIPAA regulations, each user has to have a unique ID and password.  This means that there should be no way to directly log in to “hci”.  Is there a workaround available?

Thanks,

Topic

[Dennis Pfeifer]

None that I am aware of ..

As long as the users are members of the group “staff” .. they should be able to edit files.

As far as I am aware you must be hci to start the process.

There is a sudo command that enables you to run a command as another user, but I have not used it.

I’m waiting for the shoe to drop here on the topic ..

My argument .. is .. that we must have ‘some’ super users .. much like ‘root’, or ‘administrator’ .. who have open access to the system.

The user hci has ‘open’ access to the Cloverleaf product.

Dennis

[Jim Kosloskey]

Doesn’t Advanced Security (or even Basic) allow for giving each user their own login?

email: jim.kosloskey@jim-kosloskey.com 29+ years Cloverleaf, 59 years IT - old fart.

[Rick Brown]

Jim is right on.

Basic Security uses certs for authentication which would require the user to have a valid user name and password and the proper cert on his/her machine.

Advanced Security takes it even a step further.  An administrator can lock down what parts of Cloverleaf he/she wants each user to have.

[Boris Perov]

Advanced Security???  Hell, I’m still waiting on the promised Level 1 Class!

[Dennis Pfeifer]

ok .. I’m being a little difficult .. and this is my last writing on the subject .. (I promise) ..

oops .. your host server just quit responding .. go ahead .. restart it.

oh ya .. by the way .. I’m connected via a dial-up .. run NetMonitor and stop a thread at 2:00am..

(Ok .. I’m not connected via a dial-up .. but .. it’s an example)

Do all developers need hci account access .. no ..

does someone.. yes.. and they should have 1 – 2 backups.

And this does not need to be the root..

Also .. my method of promoting an Xlate is to copy it from Dev, and not directly edit with the GUI in production (saves on typos .. err clickos).

Will the file permissions be correct if I ftp, or copy it using another account?

Guess I could use the GUI to transfer the file to my PC .. and then change sites, and transfer it to the production site.

I’ll cross this bridge when I come to it.

Dennis

[Anonymous]

On unix systems, part of the security procedures for user logins (non gui) is that you must login as yourself. After that you can su to hci.  This causes the audit trails even when becoming user hci to also show you.

That meets the security requirements 8)

[Bill Bertera]

Richard, that is what we plan to do, login as individual then su to hci. The audit logs will contain that, but there’s no way to tell specifically who did what once they became hci, is there? assuming there’s multiple users each ‘su’d’ to hci at the same time…

[Terry Kellum]

I don’t think that we (or anyone) really knows what this beast is going to look like.  As long as root exists, there will always be individual users that have access to everything down to the power supply.  Short of requiring all systems to be C2 compliant or above, there is no way to audit access to SMAT files and the like 100%.  Nothing I’ve seen is more than a band-aid on this unworkable and unreasonable requirement.  So, we’ll need to wait and see how this “item” is interpreted over time.  My guess is that the need for super-users will be validated in the end.

I also wanted the Colts in the SuperBowl……. 😀

[Author]

Replies