8 ms·

The headline should be: How we handed Google all your medical information and you didn't even know about it.

jaclaz 8y ago
Exactly. The article is from someone in the Oscar Health Insurance. According to Wikipedia, the company: https://en.wikipedia.org/wiki/Oscar_Health https://en.wikipedia.org/wiki/Oscar_Health is claiming transparency in claims pricing: >Oscar Health Insurance is a technology-focused health insurance company founded in 2012 and headquartered in New York City. The company has plans to change the health insurance industry through telemedicine, healthcare focused technological interfaces, and transparent claims pricing systems. Maybe they extended the transparency to people's health data. Here is another article (still on Medium) that incidentally talks of the Author (as engineer employed in the company): https://medium.com/oscar-tech/whats-it-like-to-be-an-engineer-at-oscar-fbaaba3ce94d https://medium.com/oscar-tech/whats-it-like-to-be-an-enginee...
- infocollector 8y ago
  Is this legal? Did they even read the TOS for Google?
  - JshWright 8y ago
    Of course it's legal. They have a BAA with Google. Do people think companies that deal with PHI have to build every service in house...? Run their own data centers? Build their own backhaul connections to their users?
    - infocollector 8y ago
      You have a copy of the BAA? (or a link?)
      - JshWright 8y ago
        Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA) Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.
        mcguire 8y ago
        "Google Cloud Platform was built under the guidance of a more than 700 person security engineering team, which is larger than most on-premises security teams." That's...encouraging.
JshWright 8y ago
I'm sure they have a BAA with Google, which holds Google to the same HIPAA PHI handling requirements.
- infocollector 8y ago
  I am not sure they do. They probably are just using Google Vision API as a regular customer. The pricing will change if Google had to do a legal deal with these folks.
  - Spooky23 8y ago
    Evidence? Getting a BAA from Google or Amazon or Microsoft is trivial.
  - JshWright 8y ago
    That would immediately trigger a company ending lawsuit. There is zero chance they are using a service for handling PHI without a BAA in place with the vendor of that service. Defending on the service provider, there may be an upfront cost for signing a BAA, but generally the service costs remain the same (assuming you stick to "BAA approved" services). In the case of Google, there is no additional cost: "As such, we can offer HIPAA regulated customers the same products at the same pricing that is available to all customers, including sustained use discounts. Other public clouds charge more money for their HIPAA cloud, we do not." https://cloud.google.com/security/compliance/hipaa/ https://cloud.google.com/security/compliance/hipaa/
RandomBookmarks 8y ago
With Abbyy and ocr.space Local there are good and (for companies) affordable local OCR solutions available. There is really no need to use online(!) OCR for sensitive data. Plus, local ocr is faster.
Spooky23 8y ago
It’s a HIPPA compliant cloud service. Google is orders of magnitude less scary than your average health insurer.
- mcguire 8y ago
  I've never dealt with HIPPA; what restrictions does it put on internal use? Who, within Google, could they share raw data with? What about "anonymized" data?
  - Spooky23 8y ago
    See: https://cloud.google.com/security/compliance/hipaa-compliance/ https://cloud.google.com/security/compliance/hipaa-complianc... Any reputable cloud service implements technical and process controls to control or eliminate access to customer data. Doing something like incorporating customer data into advertising would be a very serious situation, and frankly I doubt anyone would be that dumb at scale. Google will contractually agree to a bunch of things relative to this and has third party audits to provide additional assurance.
mav3rick 8y ago
Because that will fit the HN narrative well ?. How about commenting on the Google vision API and it's accuracy as well ?

Exactly. The article is from someone in the Oscar Health Insurance. According to Wikipedia, the company: https://en.wikipedia.org/wiki/Oscar_Health https://en.wikipedia.org/wiki/Oscar_Health is claiming transparency in claims pricing: >Oscar Health Insurance is a technology-focused health insurance company founded in 2012 and headquartered in New York City. The company has plans to change the health insurance industry through telemedicine, healthcare focused technological interfaces, and transparent claims pricing systems. Maybe they extended the transparency to people's health data. Here is another article (still on Medium) that incidentally talks of the Author (as engineer employed in the company): https://medium.com/oscar-tech/whats-it-like-to-be-an-engineer-at-oscar-fbaaba3ce94d https://medium.com/oscar-tech/whats-it-like-to-be-an-enginee...

infocollector 8y ago
Is this legal? Did they even read the TOS for Google?
- JshWright 8y ago
  Of course it's legal. They have a BAA with Google. Do people think companies that deal with PHI have to build every service in house...? Run their own data centers? Build their own backhaul connections to their users?
  - infocollector 8y ago
    You have a copy of the BAA? (or a link?)
    - JshWright 8y ago
      Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA) Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.
      - mcguire 8y ago
        "Google Cloud Platform was built under the guidance of a more than 700 person security engineering team, which is larger than most on-premises security teams." That's...encouraging.

JshWright 8y ago

I'm sure they have a BAA with Google, which holds Google to the same HIPAA PHI handling requirements.

infocollector 8y ago
I am not sure they do. They probably are just using Google Vision API as a regular customer. The pricing will change if Google had to do a legal deal with these folks.
- Spooky23 8y ago
  Evidence? Getting a BAA from Google or Amazon or Microsoft is trivial.
- JshWright 8y ago
  That would immediately trigger a company ending lawsuit. There is zero chance they are using a service for handling PHI without a BAA in place with the vendor of that service. Defending on the service provider, there may be an upfront cost for signing a BAA, but generally the service costs remain the same (assuming you stick to "BAA approved" services). In the case of Google, there is no additional cost: "As such, we can offer HIPAA regulated customers the same products at the same pricing that is available to all customers, including sustained use discounts. Other public clouds charge more money for their HIPAA cloud, we do not." https://cloud.google.com/security/compliance/hipaa/ https://cloud.google.com/security/compliance/hipaa/

RandomBookmarks 8y ago

With Abbyy and ocr.space Local there are good and (for companies) affordable local OCR solutions available. There is really no need to use online(!) OCR for sensitive data. Plus, local ocr is faster.

Spooky23 8y ago

It’s a HIPPA compliant cloud service. Google is orders of magnitude less scary than your average health insurer.

mcguire 8y ago
I've never dealt with HIPPA; what restrictions does it put on internal use? Who, within Google, could they share raw data with? What about "anonymized" data?
- Spooky23 8y ago
  See: https://cloud.google.com/security/compliance/hipaa-compliance/ https://cloud.google.com/security/compliance/hipaa-complianc... Any reputable cloud service implements technical and process controls to control or eliminate access to customer data. Doing something like incorporating customer data into advertising would be a very serious situation, and frankly I doubt anyone would be that dumb at scale. Google will contractually agree to a bunch of things relative to this and has third party audits to provide additional assurance.

mav3rick 8y ago

Because that will fit the HN narrative well ?. How about commenting on the Google vision API and it's accuracy as well ?