Re: Securing Information

True. In our environment we have other layers to deal with network security
which covers us for encryption of a data as it's transmitted, and you
definitely should do that, but that's not something a DBA would normally be
concerned with.
And given that he said that the machine may be standalone, I would suspect
that there would be a person at a directly (or nearly-directly) connected
terminal, possibly via a web app. If you're going to, for example, email
the data to someone, then it also has to be encrypted at that time, but
that would need to be re-encrypted with a method the receiver would be able
to decrypt anyway.

In any case I recommend reading the consolidated HIPAA Privacy Act
regulations (
https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/combined/hipaa-simplification-201303.pdf
).

I'm not entirely sure of the applicability of the Privacy Act of 1974 to
non-government-affiliated computers/networks, but it can't hurt to read
through that regulation for guidance as well. (
https://gsa.gov/portal/mediaId/252231/fileName/CIO_P_21001I__CHGE_1_GSA_Information_Technology_%28IT%29_Security_Policy__%28Signed_on_10-20-2015%29.action
page 35).

--
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GIT d- s+ a- C++++ L+++ S++ B+ P++>++++ E++ W+++
N o? K- !w++++ O- M- V? PS++ PE- Y+ PGP t+ 5+++
X R+ tv b+++ DI++ D++ G+ e-- h- r++ y
------END GEEK CODE BLOCK------