6 ms·
This has always worried me. My company works a lot with healthcare organisations and as a developer often my first task is to add google analytics to a page. Bu
by maxehmookau 8y ago
This has always worried me. My company works a lot with healthcare organisations and as a developer often my first task is to add google analytics to a page. But of course, this is dangerous and in the case of healthcare, should be avoided.
Google could, if it so chose, scrape the data of every user whenever they wanted to.
- DoreenMichele 8y agoTo state more clearly what you only implied, this is a potential HIPAA violation waiting to happen.
- ubernostrum 8y agoFWIW Google will sign BAAs with HIPAA-covered entities. Several of their services are popular in the industry, including Google Docs. And really, most established players in tech have HIPAA-compliant offerings and go the BAA route. It's too lucrative a sector to pass up.
- DoreenMichele 8y agoBAA is not an acronym I an familiar with and the internet assures me it is a sound a sheep makes. I would appreciate clarification. Thanks.
- ubernostrum 8y agoBusiness Associate Agreement/Addendum. Basically, when you are a covered entity -- someone who is directly required to comply with HIPAA because of what you do (for example, you're a doctor, or a pharmacy, or a health insurance company) -- any services or contractors/subcontractors you use that might end up handling protected health information as a result of what they do for you have to sign a BAA with you outlining what information they'll be receiving/handling and and how they'll be handling it, along with any specific requirements you each have to fulfill as part of your relationship. So, for example, if you are a company in the health care industry (so you're a HIPAA covered entity) and you want to use AWS for some things that involve protected health information, you need a BAA with Amazon (and Amazon will happily sign one and take your money). Google will also sign a BAA with you to let you use their cloud services, Google Docs, etc. Microsoft will sign a BAA with you. Sentry will sign a BAA with you so you can use it for monitoring on your systems. It's extra work, but health care is a big enough market to be well worth the trouble for these companies.
- amenod 8y agoApparently BAA is Business Associate Agreement: https://healthitsecurity.com/features/what-is-a-hipaa-business-associate-agreement-baa https://healthitsecurity.com/features/what-is-a-hipaa-busine...
- maxehmookau 8y agoIn the US, quite possibly. I'm surprised more hasn't be made of this before. Rules in the UK are fairly strict, although I'm unsure of how strictly enforced they are as mass-market online healthcare services are fairly few and far between since the vast majority of healthcare is provided by one provider: the state.
- kyrra 8y agoGoogle has a disclaimer about this as well. probably best to involve a lawyer to answer the questions of where and where not on a website you can use Google analytics or any analytics software when HIPAA is involved. https://support.google.com/analytics/answer/6366371?hl=en#hipaa https://support.google.com/analytics/answer/6366371?hl=en#hi...