6 ms·

If Twilio will sign a business associates agreement, this could be huge in the healthcare field. EMRs have terrible interoperability so doctors and health syste

by pg_bot 10y ago

If Twilio will sign a business associates agreement, this could be huge in the healthcare field. EMRs have terrible interoperability so doctors and health systems typically fax health records to one another. However, this service does not look HIPAA compliant based on the sparse documentation. It doesn't look promising that they will sign a BAA according to this document. https://support.twilio.com/hc/en-us/articles/223136467-Ensuring-HIPAA-compliancy-with-Twilio-made-applications https://support.twilio.com/hc/en-us/articles/223136467-Ensur...

tdeschamps 10y ago
They might have not considered this to be a big enough business opportunity when they penned this section.
- viggity 10y ago
  I'm in healthcare. I'm not kidding you, we got an 800 page fax last month from one of our clients. It wasn't a generated e-fax either, we received it electronically (we use sfax), but the lady who sent it literally printed 800 pages and put them on her fax machine. It isn't the business opportunity that is the problem (that is huge), it is the all of the HIPAA/HITECH regulations which creep into every part of your business that is the limiting factor.
  - Edmond 10y ago
    can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applicable to use cases like this that's why I am asking: https://www.cipheredtrust.com/ https://www.cipheredtrust.com/
    - Johnny555 10y ago
      There are lots of ways to securely transmit data -- which is a large part of the problem, there are so many ways to do it that there's no standard way that you can count on all of your clients/customers having access to... or trusting. But everyone trusts fax since it goes over "secure" voice lines.... even though in many cases it doesn't.
    - markolschesky 10y ago
      I wouldn't think that a Fax API provider would be exempt under the conduit exception of HIPAA/HITECH. You couldn't guarantee that the API vendor wasn't sniffing/storing/protecting data while transmitting the data between entities. You can read more about this exception here: http://www.hitechanswers.net/when-does-the-hipaa-conduit-exception-rule-apply/ http://www.hitechanswers.net/when-does-the-hipaa-conduit-exc... You would facilitate that transfer by having both parties of business associates/covered entities entering a legally binding business associates agreement to outline how PHI would be protected. Scrypt is a company that does faxing in the health tech space today and they sign BAAs and went through a HITRUST assessment. EDIT: So, maybe let me clarify what I mean about facilitating that transfer of data. So, let's say there is: Vendor ----> Health Care Provider Even if you are sending data over TLS or some other encrypted protocol, the Vendor and the Health Care Provider need to have an agreement to protect patient data and which restrict what can be done with the PHI being transmitted. If you add a new party to this equation, like: Vendor ----> Twilio ----> Health Care Provider Even if you encrypt the data to Twilio and Twilio "promises" to not store the data and promises to encrypt the data when sending it down stream, promises aren't good enough in the eyes of HIPAA/HITECH. You need to have an agreement in place like a Business Associates Agreement in which all parties agree to protect PHI. You can read more about what these agreements commonly outline here: https://datica.com/academy/business-associate-agreements/ https://datica.com/academy/business-associate-agreements/ There are exceptions to this referred to as the "Conduit Exception" of HIPAA which were clarified in 2013. This doesn't really apply to API vendors or someone like cloudflare. It applies more to phone carriers, postal services and ISPs. It's a complex topic, but I can keep jamming to discuss some of the nuances.
      - Edmond 10y ago
  - giarc 10y ago
    I work in healthcare, we get about 200-300 pages per day.
cordite 10y ago
Unless a sandboxed version can be run on site within a private network, OR they make a secure HL7 service, I do not expect healthcare to adopt this over other products like RightFax.
- faxman 10y ago
  Healthcare providers have been entrusting their faxing to outside service providers for quite a while now, without on-premise installations.
faxman 10y ago
You might want to take a look our service, Interfax, an API-powered internet fax service provider, which addresses HIPAA and offers BAA's. In fact, we cover a range of regulatory/standard requirements such as PCI-DSS (Tier 1) and EU GDPR. We're now also looking at the Oz equivalent of these types of legislation. https://www.interfax.net/en/hipaa_compliance https://www.interfax.net/en/hipaa_compliance
- gameshot911 10y ago
  I'm only familiar with RightFax in the EHR world. How does Interfax compares to it (are they even filling the same need)?
  - faxman 10y ago
    InterFAX is the SaaS version of RightFax. No installation of hardware, software, or phone lines required. (But, as with any Saas, trust in the vendor is necessary).

by pg_bot 10y ago

tdeschamps 10y ago

They might have not considered this to be a big enough business opportunity when they penned this section.

viggity 10y ago
I'm in healthcare. I'm not kidding you, we got an 800 page fax last month from one of our clients. It wasn't a generated e-fax either, we received it electronically (we use sfax), but the lady who sent it literally printed 800 pages and put them on her fax machine. It isn't the business opportunity that is the problem (that is huge), it is the all of the HIPAA/HITECH regulations which creep into every part of your business that is the limiting factor.
- Edmond 10y ago
  can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applicable to use cases like this that's why I am asking: https://www.cipheredtrust.com/ https://www.cipheredtrust.com/
  - Johnny555 10y ago
    There are lots of ways to securely transmit data -- which is a large part of the problem, there are so many ways to do it that there's no standard way that you can count on all of your clients/customers having access to... or trusting. But everyone trusts fax since it goes over "secure" voice lines.... even though in many cases it doesn't.
  - markolschesky 10y ago
    I wouldn't think that a Fax API provider would be exempt under the conduit exception of HIPAA/HITECH. You couldn't guarantee that the API vendor wasn't sniffing/storing/protecting data while transmitting the data between entities. You can read more about this exception here: http://www.hitechanswers.net/when-does-the-hipaa-conduit-exception-rule-apply/ http://www.hitechanswers.net/when-does-the-hipaa-conduit-exc... You would facilitate that transfer by having both parties of business associates/covered entities entering a legally binding business associates agreement to outline how PHI would be protected. Scrypt is a company that does faxing in the health tech space today and they sign BAAs and went through a HITRUST assessment. EDIT: So, maybe let me clarify what I mean about facilitating that transfer of data. So, let's say there is: Vendor ----> Health Care Provider Even if you are sending data over TLS or some other encrypted protocol, the Vendor and the Health Care Provider need to have an agreement to protect patient data and which restrict what can be done with the PHI being transmitted. If you add a new party to this equation, like: Vendor ----> Twilio ----> Health Care Provider Even if you encrypt the data to Twilio and Twilio "promises" to not store the data and promises to encrypt the data when sending it down stream, promises aren't good enough in the eyes of HIPAA/HITECH. You need to have an agreement in place like a Business Associates Agreement in which all parties agree to protect PHI. You can read more about what these agreements commonly outline here: https://datica.com/academy/business-associate-agreements/ https://datica.com/academy/business-associate-agreements/ There are exceptions to this referred to as the "Conduit Exception" of HIPAA which were clarified in 2013. This doesn't really apply to API vendors or someone like cloudflare. It applies more to phone carriers, postal services and ISPs. It's a complex topic, but I can keep jamming to discuss some of the nuances.
    - Edmond 10y ago
- giarc 10y ago
  I work in healthcare, we get about 200-300 pages per day.

cordite 10y ago

Unless a sandboxed version can be run on site within a private network, OR they make a secure HL7 service, I do not expect healthcare to adopt this over other products like RightFax.

faxman 10y ago
Healthcare providers have been entrusting their faxing to outside service providers for quite a while now, without on-premise installations.

faxman 10y ago

You might want to take a look our service, Interfax, an API-powered internet fax service provider, which addresses HIPAA and offers BAA's. In fact, we cover a range of regulatory/standard requirements such as PCI-DSS (Tier 1) and EU GDPR. We're now also looking at the Oz equivalent of these types of legislation. https://www.interfax.net/en/hipaa_compliance https://www.interfax.net/en/hipaa_compliance

gameshot911 10y ago
I'm only familiar with RightFax in the EHR world. How does Interfax compares to it (are they even filling the same need)?
- faxman 10y ago
  InterFAX is the SaaS version of RightFax. No installation of hardware, software, or phone lines required. (But, as with any Saas, trust in the vendor is necessary).