Storing form data on client?

[Mike]

I have developed an application, for psyc patients.... they type in
very personal information in a web form to help them work through
problems in their lives. Once they enter the info, I encrypt the data
and store it in a MySQL database. Users can then print, edit, delete
or share the information they entered with their therapist. I'm not
happy storing this in the database for two reasons: (1) my host places
restrictions on my database size and number of queries. (2) the
information is very personal and sensitive, and I'd hate to find out
the database has been compromised or damaged (even with the
encryption). Also, currently I don't have any search capabilities, but
as patients fill out large numbers of forms, they may have a need to
search.

Is there a way for me to store the form information on the visitor's
computer.... say a cookie or text file, rather than on the server side?
How would I go about doing this?

Thanks!

Mike

[Erwin Moller]

Mike wrote:

I have developed an application, for psyc patients.... they type in
very personal information in a web form to help them work through
problems in their lives. Once they enter the info, I encrypt the data
and store it in a MySQL database. Users can then print, edit, delete
or share the information they entered with their therapist. I'm not
happy storing this in the database for two reasons: (1) my host places
restrictions on my database size and number of queries. (2) the
information is very personal and sensitive, and I'd hate to find out
the database has been compromised or damaged (even with the
encryption). Also, currently I don't have any search capabilities, but
as patients fill out large numbers of forms, they may have a need to
search.

Is there a way for me to store the form information on the visitor's
computer.... say a cookie or text file, rather than on the server side?
How would I go about doing this?

Thanks!

Mike

Hi Mike,

I am unsure if storing that info on the clientmachine is very safe.
The regular home PC has worse protection than a ISP machine.
So you must warn the users that you want to store the information on their
own machine, so they can make up their own mind.

Cookies? No, Cookies won't help you. They can only store a limmited piece of
data, and surely not long writing. Also cookies are easily deleted, and
then all the data is lost. So don't go cookie.

Clients filesystem?
If you want to store information on a clientmachine, you need something else
than PHP.
PHP typically only delivers the HTML to a browser, and doesn't exists on the
clientmachine, only on the server that delivers the pages.
So you;ll need another solution: Think Java-applets, maybe
VB-script/ActiveX.
In both cases you'll need extra privileges.
I don't know much on VB-script/ActiveX, and my Javaknowledge is getting
stale (since PHP). But if you go Java, you must first master that language,
and learn how to write applets, and also learn how to sign them, and ask
the user for permissions on some folder on the filesystem. It is not
rocketscience, but Java is surely more difficult to master than PHP.

Personally, if I were in your position, I would choose a provider that suits
your needs, and keep using a serverside database, that setup is just much
easier.
ISP's come in all tastes, so if you are seriously worried about your data,
put some serious time in finding a good one. You might want to hire some
expertise to check if things are set up the way you want them to.

just my 2 cent.

Good luck.
Regards,
Erwin Moller

[Jerry Stuckle]

Mike wrote:

I have developed an application, for psyc patients.... they type in
very personal information in a web form to help them work through
problems in their lives. Once they enter the info, I encrypt the data
and store it in a MySQL database. Users can then print, edit, delete
or share the information they entered with their therapist. I'm not
happy storing this in the database for two reasons: (1) my host places
restrictions on my database size and number of queries. (2) the
information is very personal and sensitive, and I'd hate to find out
the database has been compromised or damaged (even with the
encryption). Also, currently I don't have any search capabilities, but
as patients fill out large numbers of forms, they may have a need to
search.

Is there a way for me to store the form information on the visitor's
computer.... say a cookie or text file, rather than on the server side?
How would I go about doing this?

Thanks!

Mike

Mike,

If you're in the United States, it could be even worse than that. HIPAA
regulations are quite strict on medical information, and a violation
(even an inadvertent one) can land both you and your client in jail for
a few years. At the least there would be a very large fine.

About the only way you will be able to pass HIPAA regs would be to have
a physically secure server - meaning one locked in your clients office
or similar. Otherwise someone can get in there and access your programs
- which obviously have to have the key for encrypting/decrypting the
data someplace. Also, you would need to use SSL for all communications
with sensitive information, etc.

Additionally, before medical information can be shared, even with a
therapist, you must have a signed authorization. This has to be on real
paper - a web form doesn't work.

Right now this is a VERY touchy subject in the U.S.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Mike]

Thanks for the insight... very well said, thanks!

Mike

Erwin Moller wrote:

I am unsure if storing that info on the clientmachine is very safe.

<SNIP>

Personally, if I were in your position, I would choose a provider that suits
your needs, and keep using a serverside database, that setup is just much
easier.
ISP's come in all tastes, so if you are seriously worried about your data,
put some serious time in finding a good one. You might want to hire some
expertise to check if things are set up the way you want them to.

[Mike]

Jerry,

Thanks for the reply.

I am, indeed in the US, and will check into HIPAA regs covering this.
I, nor anyone connected with the site are medical professionals. These
are visitors to my site, and not my clients. The forms are,
essentially, self-help questionnaires. They define a challenge in
their life, and use a structured process to make decisions about it.
So no actual medical information is contained in the form. It could be
something as simple as, "buy a blue car or a black one?", though other
times it can be much more personal and private. I do have warnings
prominently displayed reminding them that the data is stored on the
internet and is not guaranteed. Regarding e-mailing the form to their
therapist, they (and only they) can do that. My application simply
does what they request, with an "are you sure" message to confirm.
Still, you raise a good point, which I'll have to dig into a bit
further.

Jerry Stuckle wrote:

>
If you're in the United States, it could be even worse than that. HIPAA
regulations are quite strict on medical information, and a violation
(even an inadvertent one) can land both you and your client in jail for
a few years. At the least there would be a very large fine.

About the only way you will be able to pass HIPAA regs would be to have
a physically secure server - meaning one locked in your clients office
or similar. Otherwise someone can get in there and access your programs
- which obviously have to have the key for encrypting/decrypting the
data someplace. Also, you would need to use SSL for all communications
with sensitive information, etc.

Additionally, before medical information can be shared, even with a
therapist, you must have a signed authorization. This has to be on real
paper - a web form doesn't work.

Right now this is a VERY touchy subject in the U.S.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Jerry Stuckle]

Mike wrote:

Jerry,

Thanks for the reply.

I am, indeed in the US, and will check into HIPAA regs covering this.
I, nor anyone connected with the site are medical professionals. These
are visitors to my site, and not my clients. The forms are,
essentially, self-help questionnaires. They define a challenge in
their life, and use a structured process to make decisions about it.
So no actual medical information is contained in the form. It could be
something as simple as, "buy a blue car or a black one?", though other
times it can be much more personal and private. I do have warnings
prominently displayed reminding them that the data is stored on the
internet and is not guaranteed. Regarding e-mailing the form to their
therapist, they (and only they) can do that. My application simply
does what they request, with an "are you sure" message to confirm.
Still, you raise a good point, which I'll have to dig into a bit
further.

Mike,

It doesn't matter if you are a medical professional or not. If you are
collecting personal medical information (which can include many
self-help questions), you are subject to HIPAA regulations. And when
you get to the point it gets "personal and private", you're almost
assuredly getting into this area. And the fact these may be emailed to
a therapist makes this even more critical.

It doesn't make any difference what warnings you have posted. HIPAA
regulations REQUIRES it be guaranteed. No exceptions.

For instance - your Doctor cannot hand you a statement saying they don't
guarantee the confidentiality of your medical records. That level of
confidentiality is required by law. And only a signed statement from
you can allow that information to be released legally. And I highly
doubt a "I approve" button will pass HIPAA scrutiny.

You really need to get with an attorney familiar with HIPAA regulations
before going any further. Unless you wish to spend a few years as a
guest of the government.

Jerry Stuckle wrote:

>>If you're in the United States, it could be even worse than that. HIPAA
regulations are quite strict on medical information, and a violation
(even an inadvertent one) can land both you and your client in jail for
a few years. At the least there would be a very large fine.

About the only way you will be able to pass HIPAA regs would be to have
a physically secure server - meaning one locked in your clients office
or similar. Otherwise someone can get in there and access your programs
- which obviously have to have the key for encrypting/decrypting the
data someplace. Also, you would need to use SSL for all communications
with sensitive information, etc.

Additionall y, before medical information can be shared, even with a
therapist, you must have a signed authorization. This has to be on real
paper - a web form doesn't work.

Right now this is a VERY touchy subject in the U.S.

--
============= =====
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@att global.net
============= =====

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Mike]

Jerry,

Thanks for the feedback. I've disabled the e-mail option, just to be
on the safe side, and am looking for an attorney (hopefully pro-bono),
who can help.

Mike

[Jerry Stuckle]

Mike wrote:

Jerry,

Thanks for the feedback. I've disabled the e-mail option, just to be
on the safe side, and am looking for an attorney (hopefully pro-bono),
who can help.

Mike

Mike,

Chances are you won't find one pro bono - you're not a non-profit or
similar. And they need to make money, also.

But if you get one familiar with HIPAA it shouldn't cost you more than
an hour or two to discuss, depending on how in depth you feel you need
to go.

Of course, here in Washington, DC, 2 hours is about the same amount as
the National Debt :-)

Also, it isn't the email that will get you into trouble. It's the
collection of the data. The email just adds to the case should your
site be compromised.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===