Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm making an app that will be used in multiple hospitals in the US. As per HIPAA compliance requirement, every hospital will have its own server that complies with these requirements of ensuring patient data security, etc.

Now the task is that the app should communicate with a particular server based on the login info. An additional requirement is that new hospitals(servers) are likely to be added along the way, even after the app is available on the market.

So basically, according to some login credentials, the app should communicate with the server of the hospital assigned to that person. One pretty crude way is to set up our own server which links the hospitals with the login info and accordingly, provides a base-url for data exchange. Is there a more efficient way to handle this?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

If users have to log in, you have a DB to keep the information about users, I suppose. And if there is a security issue (I suppose there is), you have two options:

  • keep the DB in the device. Information should be securely encrypted in this case. But still I wouldn't recommend you do this: Android applications are easy to crack, so anyone could get the original source-code and decrypt info in the DB. Some applications don't even have registration on their mobile version for security reasons.
  • have the DB on a server. This is much more secure, because the information is kept only in one place. In this case logging in could be done via the server, which would determine the IP address of the hospitals' servers and send that data to the devices.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.