November 2004 - Care2x-general - lists.ourproject.org

[OT] Jornadas de HL7 Argentina
by Alejandro de Garate 18 Nov '04

18 Nov '04

Adjunto el programa de las jornadas para quien pueda estar interesado en el estandar de mensajeria HL7 para HIS. Este tema ya se ha tocado en care2x central y habria que seguirlo de cerca. --- Se invita cordialmente a concurrir y se ruega difusi�n a las personas y/o listas que Uds. dispongan. Cualquier duda adicional consultar a: dkaminker AT fibertel DOT com DOT ar Saludos cordiales Diego Kaminker HL7 Argentina Programa de las Jornadas de HL7 Argentina 25 al 27 noviembre de 2004 Hospital Italiano de Buenos Aires, Argentina Cursos abiertos a la comunidad (inscripci�n obligatoria) ---------------------------------------------------------------------- Jueves 25 13:30 a 18:00 hs. Curso Pre-Certificaci�n en HL7 v2.4 (Diego Kaminker) Requisitos : experiencia en HL7 v2.4 (avanzada si se desea certificar) Introducci�n / Control en HL7 2.X: reglas gen�ricas, como leer la especificaci�n. / Definici�n de mensajes / Formateo de Mensajes Tipos de Datos / Reglas de Procesamiento / Protocolos especiales Conclusi�n / Revisi�n del examen tipo ---------------------------------------------------------------------- Viernes 26 9:00 a 11:00 hs. Introducci�n a la versi�n 3.0 (Diego Kaminker) Requisitos : conocimientos b�sicos UML / XML. Introducci�n / Clasificaci�n de Documentos. Modelo de Informaci�n (RIM). / Tipos de Datos Abstractos. Vocabulario. / Fragmentos de mensaje reusables (CMET). Componentes para describir un dominio. / Infraestructura de transmisi�n. Especificaciones de Implementaci�n. / Especificaciones de Transporte. Ejemplos 11:00 a 12:30 hs. Taller de Interoperabilidad (Alfredo Cancio, Fernando Campos) Requisitos : conocimientos b�sicos en cualquier area de la inform�tica m�dica Trabajo por equipos / Discusion de casos. Viernes 26 13:30 a 18:00 hs. Clinical Document Architecture (Guillermo Reynoso, Marcelo Ceitlin) Introducci�n a la arquitectura de documentos cl�nicos de HL7 Documentos e interoperabilidad: Requerimientos, beneficios y conceptos b�sicos. La arquitectura de documentos cl�nicos, versi�n 1. La arquitectura de documentos cl�nicos, versi�n 2. ---------------------------------------------------------------------- S�bado 27 09:30 a 11:30 hs. Examen de Certificaci�n v2.4 (Guillermo Reynoso) (** Arancelada ** )  Examen de certificaci�n en v2.4 control enviado por HL7 USA. __________________________________ Do you Yahoo!? Meet the all-new My Yahoo! - Try it today! http://my.yahoo.com

2 1

Fw: Re: AW: [Care2002-developers] about patients and personnel in the same table
by Walter Nunez 17 Nov '04

17 Nov '04

Hi Robert, On Friday 12 November 2004 06:59, Robert Meggle wrote: > When I saw the idea of patients and personel data in the same table it was > also strange and new for me. But I think it's okay. Why not? > > Robert This could become less annoying at the PM/GP version when the clinic has very small number of employees (perhaps only one doctor and one clerk). So, one can in fact remove/disable the personnel module. elpidio -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

3 3

sobre email oficial del grupo
by Walter Nunez 16 Nov '04

16 Nov '04

Una pregunta: ¿Que pasó con el e-mail oficial? Tenía que ser un e-mail donde todos podiamos ingresar transparentemente para leer o escribir "oficialmente". Hasta ahora he hecho forward de los e-mails en care developers, en freeb developers, la lista de oshca, etc pero.... Es mi intención mantener siempre la transparencia con las personas que nos escriban o a las que escribamos. Es muy fácil configurar los clientes de correo para que no borren los mensajes del servidor, de esta manera le damos oportunidad a otro desarrollador de leer el mismo e-mail. Al cabo de algunos días si es necesario el mensaje de/para sería borrado por un "jardinero" tipo wiki. Creo que Elpidio va a separar las tablas de personal y paciente debido a las solicitudes. Un abrazo. -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

2 1

sobre nuestra distribucion que rompera en mednet 2004 y sera nuestro caballo de batalla en el 2005
by Walter Nunez 15 Nov '04

15 Nov '04

Muchachos tengo en mi casa un live-cd que funciona con el care2x, tiene opciones para mostrar el care2x en fat-32 incluso, les alcanzo los detalles técnicos: - Menu avanzado para instalar, mostrar el care2x y demás paquetes. - Es una metadistro pero no basada en las metadistros de hispalinux - Esta configurada actualmente con KDE. - Opción de funcionamiento español/inglés. - Reconocimiento de hardware. Me gusta, esta excelente. Creador: equipo de OK solution Perú Me lo alcanzo nuestro compañero de desarrollo Jaime Wong quien nos lo esta brindando y lo va a remasterizar exclusivamente para SaluX. Nuestro mensaje de salud libre abre puertas en todo lugar. ¿donde esta nuestro manifiesto? Le agradezco efusivamente a través de la lista porque ya lo hice personalmente a Jaime Wong por haber tenido la gentileza de brindarnos un año de trabajo de su equipo. Espero que cuando nos reunamos nuevamente por irc consideremos este paso inmenso que estamos dando gracias a Jaime. Un abrazo a todos. . -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

4 8

Traduccion de la ayuda
by Juan Rossano 15 Nov '04

15 Nov '04

Estimado grupo: Me consulta Denis si esta hecha la traduccion de la ayuda en el care. ¿Esta? ¿Se puede ver en algun sitio, aoniken o stmg? Saludos Juan

2 1

Fw: Re: AW: [Care2002-developers] about patients and personnel in the same table
by Walter Nunez 15 Nov '04

15 Nov '04

Hi, yes, this sql inject can be dangerous. If somebody detects any part of care2x that can be compromised, please inform us immediately. Of course, one needs to describe exactly what one did and how, which part of the program, etc. Thanks, Elpidio On Monday 15 November 2004 02:27, Daniel Ignat wrote: > Yes, you are right, that was just an example > so that people may realize the danger. > > Look in 'google' about sql inject and you will > realize that the things can get more complex, > and not only in queries about 'users' and > 'passwords', but about patient names or > clinical hisotry, for example, by people who > should not have access to that.. the 'injection' > may occur in a 'multi table' query for example, > with the password 'well' protected as you stated > here.. but with another unprotected field which > takes another user input and appends to the main > 'protected' query.. People may even save > locally the html pages, modify them to avoid the > javascript checking code and use them to query > your database.. if the server script dosen't check > thoroughly the user input.. that's why I said about > php native functions (like addslashes, as Elpidio said) > or regexp functions (more restrictive so, more secure) -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

1 0

Fw: Re: [Care2002-developers] about patients and personnel in the same table
by Walter Nunez 15 Nov '04

15 Nov '04

One word about encryption: In Linux, with the new 2.6.8.x kernel (which btw seems to be quite stable, after 6 months of testing), you have native (loop) filesystem encryption, if want it. So, you have a passphrase and if the system is stopped or rebooted, you cannot read the original data, you need to write to passphrase first in order to access the encrypted filesystem, then for that session the encryption is transparent, I mean, people who may access by any means your running computer, may read the 'encrypted' data. The 2.4.x kernel need a patch to do that, or you may use a no-native implementation (cloop ?? I am not sure) In Windows I know about a (proprietary) solution named 'PGPDisk' which lets you create an encrypted folder and there you may store your mysql data. The result is the same as above. MySQL dosen't have (as I know) native 'storing' encryption support (it may have 'transmition' encryption with OpenSSL, if compiled so) -- Daniel Ignat PHP Programmer and SysAdmin Walter Nunez wrote: > I understand of similar way, a hospital's employee gets sick and himself > becomes that hospital's patient. > This is a question of two developers Alejandro del Garate and Juan > Rossano, the main aspect will be the security of the data of the patient.. > They have so much experience in HIS at argentinian hospitals. > My first answer was about database encryption in the near future and redundancy of data, > but thinking about the future and the political decision to implementing it, we could have all the possible answers and variants > > > Thanks a lot Elpidio and Daniel > > > Walter > > Hello Walter, > > I just suggested that possibility based on my understanding of your idea to > separate the personal data of the hospital's personnel from the patient data. > Since the personal data are the same, you can use the same structure. Of > course this means that once a hospital's employee gets sick and himself > becomes that hospital's patient, you might need to reenter his personal data > as a patient. This means double work and redundancy of data. > > I personally wanted to avoid this redundancy thats why there is currently only > one person data table and it also contains the data of the hospital's > personnel. > > But I understood your last posting that you might need a true separation so I > suggested the previous solution. Please correct me if I am wrong. > > Elpidio -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

1 0

Fw: Re: AW: [Care2002-developers] about patients and personnel in the same table
by Walter Nunez 15 Nov '04

15 Nov '04

Yes, you are right, that was just an example so that people may realize the danger. Look in 'google' about sql inject and you will realize that the things can get more complex, and not only in queries about 'users' and 'passwords', but about patient names or clinical hisotry, for example, by people who should not have access to that.. the 'injection' may occur in a 'multi table' query for example, with the password 'well' protected as you stated here.. but with another unprotected field which takes another user input and appends to the main 'protected' query.. People may even save locally the html pages, modify them to avoid the javascript checking code and use them to query your database.. if the server script dosen't check thoroughly the user input.. that's why I said about php native functions (like addslashes, as Elpidio said) or regexp functions (more restrictive so, more secure) - Daniel Ignat PHP Programmer and SysAdmin Robert Meggle wrote: > Hi Daniel, > > mysql 'sql inject' attack try : > SQL query: SELECT * FROM uers WHERE user='".$user."' AND > password='".$passwd."'" > instead of > SQL query: SELECT * FROM uers WHERE user="$user" AND password="$passwd" > > The password: aa" or 1=1" will produce follwing (php) SQL-query: > "SELECT * FROM uers WHERE user='test" AND password='aa\" or 1=1\"' > instead of > "SELECT * FROM uers WHERE user=test AND password=aa or 1=1" > > Effecive no positive result for the bad gui. > > When I saw the idea of patients and personel data in the same table it was > also strange and new for me. But I think it's okay. Why not? > -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

1 0

Fw: Re: [Care2002-developers] about patients and personnel in the same table
by Walter Nunez 15 Nov '04

15 Nov '04

Hi Elpidio, I don't have any problem with that, and I think it is the most reasonable way to answer to my 'proposal'. I appologize for not having too much time (I write to this list from my work, and a company needs to have productive people, not 'talkie' ones.. and at house I have other duties - I will become father soon, and my wife is a lot more important than 'computer stuff'.. so, maybe my messages are incomplete as solutions, or I suppose things that are not real (like an sql inject vulnerability), but I do what I can and I simply wanted that the people on this list be aware of that, if thery are not yet.. I also want to say that my opinion is just that: an opinion. I am a programer, but a programmer who is also a user and likes to think about clear user interfaces. So, it seems to me logic to separate staff and patient and I *proposed* a solution. If it seems good to the developers team who really do the job and may have other, much more important things to do.. well. If they find it good and have time to do it, that is very well, if not, there is no problem. I do not want to impose my opinions to anybody.. We shoudn't react too hard to the opinions here in the list, but to take them as good if they are good or as bad if they are bad, as mature people do. I personally do not like un-ending and un-productive discussions like in other forums.. -- Daniel Ignat PHP Programmer and SysAdmin Elpidio Latorilla wrote: > Hi Daniel Ignat, > > thanks for the good ideas. They are all correct solutions. > > The final decision lies on the hands of Walter and his team. If they need to > add more controls on the search page, they should do it. The basic principle > here is: > > " Do not do what Care2x wants you to do, but do what is needed to solve your > own problem ". > > Since a problem could have many variants, the solution could have many > variants too. If it is proven (in practice) that one's variant applies to > most cases, it will be taken over to the main release versions. > > In any case, I would like to remind all of us that when we design a solution > to a problem, let us think like a non-programmer or non-technical person > because the end-user of care2x does not think like a programmer. > > Best regards, > Elpidio > > > On Friday 12 November 2004 02:24, Daniel Ignat wrote: > >>Hi! >> >>I saw that also and it seems to me a little bit >>annoying to mix personnel and patients.. but you >>also are right about duplicate data if someone >>from the personnel gets sick.. >> >>so, my suggestion is this (for the main developers >>of care2x): is it possible to put an unchecked >>'check box' in the 'search person' form, so that >>you may 'include', *if you want* the personnel >>data (as an exception), in the search query?.. >> >>or maybe better, 2 radio buttons: >> - only personnel, only patients >>this way you will not have to look for all the >>patients (including the filter) either when looking >>for personnel.. >> >>it is not difficult for the developer who has done >>that form, but it would be a great feature for the >>user. there is only one check box with a text, then >>a filter in the sql query.. -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

1 0

Fw: Re: [Care2002-developers] about patients and personnel in the same table
by Walter Nunez 13 Nov '04

13 Nov '04

Subject: Re: [Care2002-developers] about patients and personnel in the same table ---- Hello Juan and Walter, you can create a new class that inherits the person class and then in its constructor function you just define the new table name for your personnel table (granting the table structure is the same as care_person).: class Personnel extends Person { function Personnel(){ $this->tb_person = 'care_person_personnel'; } } Then in your scripts, you have to use the Personnel class and not the Person class. Elpidio -- Walter Alfonso Núnez Rivera Médico - Programador Pascual de Andagoya 140 Lima 32 Perú

4 9