4 ms·

This both sucks and is great. Sucks for me. Hopefully will be great for Mattermost and Matrix. For HIPAA compliant shops Slack is a non-starter. Mattermost wil

This both sucks and is great. Sucks for me. Hopefully will be great for Mattermost and Matrix. For HIPAA compliant shops Slack is a non-starter. Mattermost will hopefully get a lot of corporate $ now. I wish Matrix's dendrite[0] golang replacement homeserver was finished and in better shape. I'd much prefer to go the Riot/Matrix route, but it doesn't feel ready for prime time yet. HipChat Server was SPOF but could be made to be HIPAA compliant by hoisting their AMI out and encrypting the base image. I literally was at the tail end of hacking Hipchat Data Center to be fully HIPAA compliant and HA using Vault, Consul (+locks), Terraform, scaling groups and friends. I was so excited about getting to blog about it. sigh Looks like I'll be re-engaging Mattermost. Last time I looked their E20 pricing was like 4x more expensive per user than it was costing for HipChat DC. Hopefully they finished their HipChat importing option. [0] https://github.com/matrix-org/dendrite https://github.com/matrix-org/dendrite

adrianpike 8y ago
Hey, can you elaborate a touch on the lack of HIPAA compliance with Slack? Some folks on my team seem to think it's compliant - and I'm not finding true hard answers either way (ignoring the BAA side of things)
- ceruleanscott 8y ago
  Slack showcases the HIPAA logo on their security page, but upon closer inspection - https://slack.com/terms-of-service/supplement#healthcare https://slack.com/terms-of-service/supplement#healthcare - you'll see that unless you've signed a separate agreement with them, you acknowledge that Slack is not HIPAA compliant and that you are not to send them any PHI. My guess: they are signing BAAs for grid customers only (so the logo isn't a lie) and making them pay handsomely for the pleasure. As I shamelessly disclosed upthread, we (Trillian) offer a HITRUST certified, BAA-backed solution for healthcare organizations that comes in SaaS and on-prem variants. More: https://trillian.im/uses/hipaa-compliant-texting/ https://trillian.im/uses/hipaa-compliant-texting/
- deleted 8y ago
  [deleted]

adrianpike 8y ago

Hey, can you elaborate a touch on the lack of HIPAA compliance with Slack? Some folks on my team seem to think it's compliant - and I'm not finding true hard answers either way (ignoring the BAA side of things)

ceruleanscott 8y ago
Slack showcases the HIPAA logo on their security page, but upon closer inspection - https://slack.com/terms-of-service/supplement#healthcare https://slack.com/terms-of-service/supplement#healthcare - you'll see that unless you've signed a separate agreement with them, you acknowledge that Slack is not HIPAA compliant and that you are not to send them any PHI. My guess: they are signing BAAs for grid customers only (so the logo isn't a lie) and making them pay handsomely for the pleasure. As I shamelessly disclosed upthread, we (Trillian) offer a HITRUST certified, BAA-backed solution for healthcare organizations that comes in SaaS and on-prem variants. More: https://trillian.im/uses/hipaa-compliant-texting/ https://trillian.im/uses/hipaa-compliant-texting/
deleted 8y ago
[deleted]