>
It doesn't really matter that SOME people MAY have remote access, John. I do not and therefore chose to write code that I can maintain. It is your perogative to consider it inferior.
>

Nonetheless, the primary point is that you not having remote access is not mandated by the new regs and it is important the record is clear since readers of this thread may be mislead. At best, this is something the client has elected to do. My guess is the client is either mis-educated or mis-informed. If a client had reservations about remote access, I would make every attempt to determine the basis of those reservations.

You do realize that just because you do not have remote access to the server, that does not preclude the use of stored procs. No doubt - they have dba's on board. That said, it does not sound like a strong dba role since they are allowing client-side rendered sql to be sent to the db server.

And this gets to the irony of the situation...

You see Lynda, if the security of the data were *really* at issue - then stored procs would have been mandated. The irony here is that while a lack of remote access exists because of the new privacy regs - access to the database is allowed in a relatively unsecure manner.

Also, it is interesting that you chose to go the route that made it (seemingly) easier for you to maintain as opposed to what would be a better architecture for the client. I say seemingly because maintaining client-side embedded SQL that is passed to a server actually requires more effort to maintain. My guess is that stored procs were probably not presented as an option to the client.

Lynda...it is not my intention to bash your for the decision you made. Ultimately, you made the call you thought was right. Having a good deal of experience in these kinds of systems, all I can say is that I would not advise others to go the route you chose. That is the great thing about forums like this... :)

I know your precise scenario because I encountered the EXACT same issue. Ultimately, I was given remote access - but it took a while. In the mean time, I worked with the DBA when I could not be on-site. When I was on-site - I could do everything myself. And to be clear, my client is a major broker for healthcare benefits.

IAC - best of luck...