3 ms·

"HIPAA Compliance Guaranteed" seems like a strong statement to make. Just out of curiosity, can you explain what you mean by that? I mean, if you're allowing "

by spokey 16y ago

"HIPAA Compliance Guaranteed" seems like a strong statement to make. Just out of curiosity, can you explain what you mean by that? I mean, if you're allowing "custom reminders" how do you know they aren't recording "Mr. Smith, we have the results of your HIV test and it's positive." or "This a reminder for you to come in for your colonoscopy" or something like that? Are your custom reminders more templated than that?

patio11 16y ago
Just out of curiosity, can you explain what you mean by that? It means that, if you don't see a check in that column, you're on notice that HIPAA compliance is not guaranteed. (Looking at my competitors shows that some invest a lot of effort into HIPAA compliance and some insist that it is out of scope for simple appointment reminders. My approach is a little different: I'll deal with the lawyers and regulatory angle, but not right now.) If in spite of the plain language of the table and eventual language in the TOS folks insist on putting sensitive information on a service which is not rated for sensitive information, I'll say the same thing Gmail or Facebook would: I had no idea they were doing that, did not encourage it, and if you want to sue someone please sue them.
- spokey 16y ago
  I think you misunderstood my question. I'm asking: what are you doing to guarantee HIPAA compliance? I.e., what's different about how you treat those accounts than the others and/or what steps are you taking to ensure compliance?
  - spokey 16y ago
    Patrick, Reading over your response again it seems like you're saying that you're not doing anything to ensure HIPAA compliance and possibly that the HIPAA compliant premium option is only there to contrast with the other account types. Is that right? If that's the case, why not just cover this in the TOS or with an on-page note like "NB: AppointmentReminder is not currently appropriate for HIPAA sensitive information." (Or some rephrasing of that that makes more sense.) I'm confused why you're listing an account type you're not really willing to sell, or if you're intending to sell it, I'm curious what you intend to do to ensure compliance. Of course, if you're not comfortable disclosing your plans here, or if you haven't yet figured them out, by all means disregard this question. I don't have any skin in this, I'm just curious.

by spokey 16y ago

patio11 16y ago

Just out of curiosity, can you explain what you mean by that? It means that, if you don't see a check in that column, you're on notice that HIPAA compliance is not guaranteed. (Looking at my competitors shows that some invest a lot of effort into HIPAA compliance and some insist that it is out of scope for simple appointment reminders. My approach is a little different: I'll deal with the lawyers and regulatory angle, but not right now.) If in spite of the plain language of the table and eventual language in the TOS folks insist on putting sensitive information on a service which is not rated for sensitive information, I'll say the same thing Gmail or Facebook would: I had no idea they were doing that, did not encourage it, and if you want to sue someone please sue them.

spokey 16y ago
I think you misunderstood my question. I'm asking: what are you doing to guarantee HIPAA compliance? I.e., what's different about how you treat those accounts than the others and/or what steps are you taking to ensure compliance?
- spokey 16y ago
  Patrick, Reading over your response again it seems like you're saying that you're not doing anything to ensure HIPAA compliance and possibly that the HIPAA compliant premium option is only there to contrast with the other account types. Is that right? If that's the case, why not just cover this in the TOS or with an on-page note like "NB: AppointmentReminder is not currently appropriate for HIPAA sensitive information." (Or some rephrasing of that that makes more sense.) I'm confused why you're listing an account type you're not really willing to sell, or if you're intending to sell it, I'm curious what you intend to do to ensure compliance. Of course, if you're not comfortable disclosing your plans here, or if you haven't yet figured them out, by all means disregard this question. I don't have any skin in this, I'm just curious.