IWP security

[dkemme]

Is the security for IWP robust enough to trust for delivering medical records over the internet? How about an intranet within a hospital?

Version: Developer v7

Platform: Mac OS X Panther

[jfmcel]

If you have an internal system that you feel meets the HIPPA requirements and you use an SSL to transmit the data, it seems like IWP is pretty close. I think, however, that the built in user authentication does not pass the muster. A big problem I have found is that the session expiration does not really work. You are taken back to the home page and you are not required to login back in to reenter the database. Another problem would be that browsers prompt to remember passwords. I think that HIPPA regulations require you to use a more rigorous method for authenticating users.

[Possibly, a VPN is the best method to access a sensitive FM database over the internet.]

[Steven H. Blackwell]

OK, time out.

Please do not confuse the limited capacity IWP in FileMaker Pro 7 client with the new IWP capabilities that will exist in FileMaker Server 7 Advanced. Using either Apache (OS X Server) or IIS6 (Windows Server 2003) you can support https SSL encryption all the way to the database server--IF IF IF you configure the system correctly at all the points along the way.

Data encryption in FileMaker Server 7 Advanced is strong. The log-ons carry through from the database to the web browser.

While I am not sure that I would necessarily recommend a web based approach here, it can be used. Remember that you are limited to 100 web connections at a time. But the idle timeout can be used to clear out folks on a short time interval.

Please see the Web Publishing Tech Brief at:

http://www.filemaker.com/upgrade/techbriefs.html

HTH

Steven