I’m making an app that will be used in multiple hospitals in the US. As per HIPAA compliance requirement, every hospital will have its own server that complies with these requirements of ensuring patient data security, etc.
Now the task is that the app should communicate with a particular server based on the login info. An additional requirement is that new hospitals(servers) are likely to be added along the way, even after the app is available on the market.
So basically, according to some login credentials, the app should communicate with the server of the hospital assigned to that person. One pretty crude way is to set up our own server which links the hospitals with the login info and accordingly, provides a base-url for data exchange. Is there a more efficient way to handle this?
If users have to log in, you have a DB to keep the information about users, I suppose. And if there is a security issue (I suppose there is), you have two options:
- keep the DB in the device. Information should be securely encrypted in this case. But still I wouldn’t recommend you do this: Android applications are easy to crack, so anyone could get the original source-code and decrypt info in the DB. Some applications don’t even have registration on their mobile version for security reasons.
- have the DB on a server. This is much more secure, because the information is kept only in one place. In this case logging in could be done via the server, which would determine the IP address of the hospitals’ servers and send that data to the devices.