Maintaining HIPAA Compliance Using Views in MySQL

Question

Problem

We have a large web application that stores and displays sensitive data related to HIPAA. We are currently exploring ways to improve HIPAA compliance and reduce the risk of disruption.

Currently, there are several functions and reports that do not correctly limit information about the client based on the permissions of the person who registered (for example, the ability to search for clients and some outdated reports).

Possible solutions

Take care of the problem programmatically

We can always simply rewrite sections of code that cause non-compliance. The problem is that this approach is highly error prone, given the scale of the application — material may be skipped.

Modifying the database to limit returned data

We could change the structure of the MySQL database to display the necessary permissions needed in the application. Thus, no one can see data that they should not, because the database will not return data that they should not see.

My question

There are about 300 tables in the application itself, most of which store some kind of confidential data. Is it possible (and possible) to use MySQL views to restrict access to data?

If so, what is the best approach?

Answer 1

You can use the view to limit or present any data you want by simply modifying the query used in the view.

, , " ", .

, , . -. , . ( "DOB" , "01 -01-2001" DOB).

MYSQL , .

CREATE TABLE t (qty INT, price INT);
mysql> INSERT INTO t VALUES(3, 50);
mysql> CREATE VIEW v AS SELECT qty, price, qty*price AS value FROM t;
mysql> SELECT * FROM v;

http://dev.mysql.com/doc/refman/5.0/en/create-view.html