We are currently evaluating whether PHI (Protected Health
Information) should/can be stored in our portal. Currnently we do
not allow it. We do have our portal set up over https with AD
authentication. We are not that happy though with the idea that
files can be downloaded, and that they are accessible from any
computer.

One idea we were looking at was using ISAServer to verify that the
machine/user (laptop) has a valid certificate in addition to AD
crendentials to access PHI information, with the goal of preventing
users from accessing PHI with a non-company computer. To further
restrict file permissions, we are also looking at IRM.

My question is if anyone has had any expreience with either of these
solutions or others. Also, if there are any concerns with either of
the technologies and using them with SharePoint.

We don't necessarily want to retstirct our entire portal this way,
just the component that would potentially contain PHI. My thought is
we would probably have to create a separate web app to host the PHI
so we could contain it more effectivley. I am not sure if it is
possible to apply any of the above within a web app only at certial
libraries, etc. Our ultimate goal would be to not allow any
documents containing PHI to be downloaded, only viewed and saved back
to the server. Any thoughts or advice would be great.