3 ms·

Exactly. The article is from someone in the Oscar Health Insurance. According to Wikipedia, the company: https://en.wikipedia.org/wiki/Oscar_Health https://e

by jaclaz 8y ago

Exactly. The article is from someone in the Oscar Health Insurance. According to Wikipedia, the company: https://en.wikipedia.org/wiki/Oscar_Health https://en.wikipedia.org/wiki/Oscar_Health is claiming transparency in claims pricing: >Oscar Health Insurance is a technology-focused health insurance company founded in 2012 and headquartered in New York City. The company has plans to change the health insurance industry through telemedicine, healthcare focused technological interfaces, and transparent claims pricing systems. Maybe they extended the transparency to people's health data. Here is another article (still on Medium) that incidentally talks of the Author (as engineer employed in the company): https://medium.com/oscar-tech/whats-it-like-to-be-an-engineer-at-oscar-fbaaba3ce94d https://medium.com/oscar-tech/whats-it-like-to-be-an-enginee...

infocollector 8y ago
Is this legal? Did they even read the TOS for Google?
- JshWright 8y ago
  Of course it's legal. They have a BAA with Google. Do people think companies that deal with PHI have to build every service in house...? Run their own data centers? Build their own backhaul connections to their users?
  - infocollector 8y ago
    You have a copy of the BAA? (or a link?)
    - JshWright 8y ago
      Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA) Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.
      - mcguire 8y ago
        "Google Cloud Platform was built under the guidance of a more than 700 person security engineering team, which is larger than most on-premises security teams." That's...encouraging.

by jaclaz 8y ago

infocollector 8y ago

Is this legal? Did they even read the TOS for Google?

JshWright 8y ago
Of course it's legal. They have a BAA with Google. Do people think companies that deal with PHI have to build every service in house...? Run their own data centers? Build their own backhaul connections to their users?
- infocollector 8y ago
  You have a copy of the BAA? (or a link?)
  - JshWright 8y ago
    Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA) Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.
    - mcguire 8y ago
      "Google Cloud Platform was built under the guidance of a more than 700 person security engineering team, which is larger than most on-premises security teams." That's...encouraging.