6 ms·

As someone who most recently worked in product at a healthcare startup I found the most difficult thing about innovation in the space is the cost of compliance/

As someone who most recently worked in product at a healthcare startup I found the most difficult thing about innovation in the space is the cost of compliance/regulation. When you work in an industry that is so highly regulated, and assuming you are working at a company that follows the rule of law, how do you actually "disrupt" a set of problems in this industry when there is so little wiggle room for doing things differently? Following legal guidelines in healthcare means reenforcing bad norms rather than disrupting them. One of the biggest WTF moments I had when I first started was realizing that fax communication is HIPAA-compliant whereas email/SMS are not, even though in theory anyone could walk by a fax machine at any time and take medically sensitive information sent over.

newman8r 9y ago
I'm pretty sure email can be HIPAA compliant as long as you implement the system using the established guidelines.
- toomuchtodo 9y ago
  Indeed it is as long as you’ve configured your email system to use TLS and not downgrade to no encryption if the handshake fails for mail systems where HIPAA-governed information is departing to. Source: Not a lawyer, not your lawyer. Sign off provided by non profit bio research orgs lawyer before I set it up.
  - newman8r 9y ago
    This is my understanding as well. Additionally, I believe you can send encrypted attachments over an unencrypted connection. Furthermore, https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.p... suggests that it's acceptable to send patients unencrypted PHI if they've explicitly agreed to accept the risks associated with that (although I'd be extremely cautious in those situations)
  - Spooky23 9y ago
    That’s more for B2B use cases. Like between a medical practice and hospital. The unreliability of delivery to destinations that don’t support TLS will create customer service issues in B2C scenarios.
- Clubber 9y ago
  Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body. The email becomes just a notification via SMTP. The recipient then goes to the site and logs in to view the email. The PHI is what you care about (and it's, very, very strict). No PHI in the subject either. I suspect the reason faxes are compliant is a few: 1. Grandfathered in. 2. The number of unauthorized people that can see them is very limited (to whomever has access to the fax machine). 3. Modern fax machines print face down. 4. Data is in hard copy format which is more difficult to copy. As an aside, modern fax machines are probably less secure than the old ones. Fax machines using digi-boards and databases and whatnot. The vast majority of US healthcare use faxes though.
  - u801e 9y ago
    > Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?
    - Clubber 9y ago
      >Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.
killjoywashere 9y ago
Aerospace also has high compliance hurdles. But rockets are extremely phallic. Even urology can't beat aerospace on that axis. And yes, having been in this space for a while, the fax is a great example, a loophole for lawyers, who still do lots of paperwork by fax, because there's case law to support the practice (not the security mind you, just the practice). Neither the lawyers nor the doctors understand math. Between the two, the lawyers at least took a formal logic course. Doctors think most of the software they use is just magic, if they think of it at all. The only other association with computers that they have is the IT guy who comes to replace their tower every other year.
ryanSrich 9y ago
FWIW, healthcare compliance is a solved problem (disclaimer: I work for the company that solved it - Datica.com). The larger problem is that young companies don't understand what it takes to be compliant, nor the resources to do it themselves. Remember, compliance is all about proving what you say you do. If you can prove it, you're golden. So it's not that SMS or email isn't HIPAA compliant, it's that the work, controls, and monitoring you'd need to put in place to prove compliance is a massive burden. This is where risk management comes into play. If risk isn't a core tenant of your offering, you're better off building the preferred UX (like using email over fax) and assuming no risk.
gumby 9y ago
It could be your mindset. When I worked in drug development (wet chemistry and lots of animal studies) the regulation, while everpresent, just didn’t seem like any kind of burden when compared to everything else we had to deal with.
junkscience2017 9y ago
so ELI5 why we shouldn't just get rid of HIPAA? from the way people talk, all HIPAA does is guarantee that things will always be awful(?) how does HIPAA help if it just keeps us in the past?
- MBCook 9y ago
  It’s also the law that prevents doctors from telling their friends about your hilarious medical conditions, or selling information about you to pharmaceutical companies to market to you directly. It’s a very thorny law, but it’s like that for a reason.
- mulmen 9y ago
  For the same reason you won't call Uber to take you to the hospital if you cut off your arm.
dragonwriter 9y ago
> One of the biggest WTF moments I had when I first started was realizing that fax communication is HIPAA-compliant whereas email/SMS are not That's not exactly the case; fax communication can easily violate HIPAA and email, appropriately secured, can be compliant, even for PHI (SMS is more problematic because it's unsecurable). The issue is specifically that there is precedent (or, at least, a widely held interpretation, not sure there is actually directly applicable case law) that fax is not an electronic communication mechanism for the purposes of HIPAA law and regulation, so while general rules on disclosure and communication apply to it. > even though in theory anyone could walk by a fax machine at any time and take medically sensitive information sent over. Not having appropriate safeguards to prevent that at a HIPAA covered entity is, itself, a violation of HIPAA.
finnthehuman 9y ago
I work in medical devices. The regulation can be unnecessarily prohibitive, but more often than not I see it used as a cop-out. Where one entrepreneur says "the status quo in this space is so behind the times I can't work there," another says "there are enhancements waiting to be back-ported into this tightly controlled space from domains that have already been proven it to be a good idea." Only one of those people knows how to make money. That's just the low-hanging fruit. And there's so much of it. Foot-stomping about having a formal quality system instead of "move fast and break things" is letting the perfect be the enemy of good.
u801e 9y ago
> fax communication is HIPAA-compliant whereas email/SMS are not I thought that HIPAA had the provision that stated that encrypted communication is compliant. That is, if the email or SMS was encrypted, then it would be in compliance with the act.
nradov 9y ago
The Direct Project has an SMTP implementation which allows for emailing medical data in a secure, HIPAA compliant way. http://wiki.directproject.org/SMTP+Implementation+Development+Team http://wiki.directproject.org/SMTP+Implementation+Developmen...

newman8r 9y ago

I'm pretty sure email can be HIPAA compliant as long as you implement the system using the established guidelines.

toomuchtodo 9y ago
Indeed it is as long as you’ve configured your email system to use TLS and not downgrade to no encryption if the handshake fails for mail systems where HIPAA-governed information is departing to. Source: Not a lawyer, not your lawyer. Sign off provided by non profit bio research orgs lawyer before I set it up.
- newman8r 9y ago
  This is my understanding as well. Additionally, I believe you can send encrypted attachments over an unencrypted connection. Furthermore, https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.pdf https://www.gpo.gov/fdsys/pkg/FR-2013-01-25/pdf/2013-01073.p... suggests that it's acceptable to send patients unencrypted PHI if they've explicitly agreed to accept the risks associated with that (although I'd be extremely cautious in those situations)
- Spooky23 9y ago
  That’s more for B2B use cases. Like between a medical practice and hospital. The unreliability of delivery to destinations that don’t support TLS will create customer service issues in B2C scenarios.
Clubber 9y ago
Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body. The email becomes just a notification via SMTP. The recipient then goes to the site and logs in to view the email. The PHI is what you care about (and it's, very, very strict). No PHI in the subject either. I suspect the reason faxes are compliant is a few: 1. Grandfathered in. 2. The number of unauthorized people that can see them is very limited (to whomever has access to the fax machine). 3. Modern fax machines print face down. 4. Data is in hard copy format which is more difficult to copy. As an aside, modern fax machines are probably less secure than the old ones. Fax machines using digi-boards and databases and whatnot. The vast majority of US healthcare use faxes though.
- u801e 9y ago
  > Re email: Because you don't know if the destination server is encrypted (you send emails from your server and it finds the destination), any email must be intercepted at your server and a hyperlink to a secure site inserted in place of the email body Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. On the subject of fax machines, would they still be compliant if they're connected to a VOIP system?
  - Clubber 9y ago
    >Couldn't this be solved by just encrypting the email itself? Even the headers could be encrypted along with the body. Yes, but that's typically more cumbersome as you have to trade keys with everybody that needs an email. I wrote an emailer for a medium sized company and it sent about 500K emails and 500K faxes a month. That's a lot of key management. You could use symmetric encryption, but then you give out the shared key to so many people, it tends to lose value, especially when you don't control how your recipient organizations protect the key. (it could be in a file on a shared folder named Email-EncryptionKey.txt). On top of all that, each client will have to be taught how to decrypt (and encrypt) emails, either at the employee level or at the network admin level. Most provider organizations are small. Typically a doctor or two with a nurse and a couple people working the schedule and regulatory. In summary, it would achieve the objective but it's not ideal. >On the subject of fax machines, would they still be compliant if they're connected to a VOIP system? Yes, as long as no PHI went over an unencrypted channel and all servers are secured (physical and computational) and logged.

killjoywashere 9y ago

Aerospace also has high compliance hurdles. But rockets are extremely phallic. Even urology can't beat aerospace on that axis. And yes, having been in this space for a while, the fax is a great example, a loophole for lawyers, who still do lots of paperwork by fax, because there's case law to support the practice (not the security mind you, just the practice). Neither the lawyers nor the doctors understand math. Between the two, the lawyers at least took a formal logic course. Doctors think most of the software they use is just magic, if they think of it at all. The only other association with computers that they have is the IT guy who comes to replace their tower every other year.

ryanSrich 9y ago

FWIW, healthcare compliance is a solved problem (disclaimer: I work for the company that solved it - Datica.com). The larger problem is that young companies don't understand what it takes to be compliant, nor the resources to do it themselves. Remember, compliance is all about proving what you say you do. If you can prove it, you're golden. So it's not that SMS or email isn't HIPAA compliant, it's that the work, controls, and monitoring you'd need to put in place to prove compliance is a massive burden. This is where risk management comes into play. If risk isn't a core tenant of your offering, you're better off building the preferred UX (like using email over fax) and assuming no risk.

gumby 9y ago

It could be your mindset. When I worked in drug development (wet chemistry and lots of animal studies) the regulation, while everpresent, just didn’t seem like any kind of burden when compared to everything else we had to deal with.

junkscience2017 9y ago

so ELI5 why we shouldn't just get rid of HIPAA? from the way people talk, all HIPAA does is guarantee that things will always be awful(?) how does HIPAA help if it just keeps us in the past?

MBCook 9y ago
It’s also the law that prevents doctors from telling their friends about your hilarious medical conditions, or selling information about you to pharmaceutical companies to market to you directly. It’s a very thorny law, but it’s like that for a reason.
mulmen 9y ago
For the same reason you won't call Uber to take you to the hospital if you cut off your arm.

dragonwriter 9y ago

> One of the biggest WTF moments I had when I first started was realizing that fax communication is HIPAA-compliant whereas email/SMS are not That's not exactly the case; fax communication can easily violate HIPAA and email, appropriately secured, can be compliant, even for PHI (SMS is more problematic because it's unsecurable). The issue is specifically that there is precedent (or, at least, a widely held interpretation, not sure there is actually directly applicable case law) that fax is not an electronic communication mechanism for the purposes of HIPAA law and regulation, so while general rules on disclosure and communication apply to it. > even though in theory anyone could walk by a fax machine at any time and take medically sensitive information sent over. Not having appropriate safeguards to prevent that at a HIPAA covered entity is, itself, a violation of HIPAA.

finnthehuman 9y ago

I work in medical devices. The regulation can be unnecessarily prohibitive, but more often than not I see it used as a cop-out. Where one entrepreneur says "the status quo in this space is so behind the times I can't work there," another says "there are enhancements waiting to be back-ported into this tightly controlled space from domains that have already been proven it to be a good idea." Only one of those people knows how to make money. That's just the low-hanging fruit. And there's so much of it. Foot-stomping about having a formal quality system instead of "move fast and break things" is letting the perfect be the enemy of good.

u801e 9y ago

> fax communication is HIPAA-compliant whereas email/SMS are not I thought that HIPAA had the provision that stated that encrypted communication is compliant. That is, if the email or SMS was encrypted, then it would be in compliance with the act.

nradov 9y ago

The Direct Project has an SMTP implementation which allows for emailing medical data in a secure, HIPAA compliant way. http://wiki.directproject.org/SMTP+Implementation+Development+Team http://wiki.directproject.org/SMTP+Implementation+Developmen...