View source for Talk:End-user device encryption (MU3)

This refers to data that remains on a user's device after they log out of the program. Breaches have occurred when users had laptops stolen that were not encrypted and stored the entire database on the laptop. Since the usual access to OpenEMR is by HTTPS connection, I think all that's required is that data from the session not be cached.

There's a technical discussion of this on Stack Overflow 
https://stackoverflow.com/questions/49547/how-do-we-control-web-page-caching-across-all-browsers


Basically puts this on each page:

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: 0