4 ms·

Work for a medical billing company owned by a physician group, had somebody in from Google a month or two ago wanting access to a stream of patient data from us

Work for a medical billing company owned by a physician group, had somebody in from Google a month or two ago wanting access to a stream of patient data from us in exchange for building some software for us. There was absolutely no detail on what they thought they could build, just that they would see what they could come up with after we started feeding them data. The architect on our team immediately began laughing in the meeting, as it's clear that Google has absolutely zero idea how HIPAA works.

jchw 8y ago
...Google definitely understands how HIPAA works. GCP and G Suite both have HIPAA compliance to varying degrees. I don't think that person had any chance of getting clearance to do that from the G side, less your side.
- snuxoll 8y ago
  From a G Suite / GCP point of view they really only have to worry about the HIPAA Security Rule, most of which can be punted off on the client (they need to audit and control access to the platform, proper breach notifications and a BAA - the rest is mostly up to the client). Collecting patient health records starts bringing the HIPAA Privacy Rule into play, which they have zero experience with.
  - jchw 8y ago
    Fair enough, but the other statement I still stand by: I don't think that deal would've been signed off on regardless. My impression from working here is that pretty much any use of any data goes through a fairly rigorous review process. I'm sure there was a point in time when that wasn't the case, but today it sure seems to be.
- Sylos 8y ago
  If the guy is high enough up in the hierarchy, there's a good chance that he can sign off on even illegal things. Looking at how Google is handling the GDPR, for example, there's just as well plenty obvious violations that someone had to sign off on and that are gonna cost them a few billions once they can't drag the lawsuits out any longer. In the meantime, though, they're very likely making enough money to offset that, which is why executives can sign off on illegal things in the first place. It's just a basic risk analysis in the end.
  - jchw 8y ago
    I only take objection to the idea that because one employee in a company made a proposal that was not legal, that this is somehow representative of a company is ran. Engineers aren't lawyers, that's why there's a process for them to speak to lawyers in any sane large company, usually requiring approval for things that are especially important like handling sensitive data. Google isn't even special here.
saulrh 8y ago
You know what the really stupid thing is? Looking at the attack surfaces and data values and compromise histories, and having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat. If you're saying that Google would need to learn about a brand new truckload of paperwork, sure. But HIPAA is neither necessary nor sufficient for privacy or security.
- snuxoll 8y ago
  The problem is HIPAA doesn't allow one to share data without a reason - in fact it's only to be ACCESSED with a reason even by those with privileges to do so. I would trust Google to keep data safe, but brazenly asking for data without a defined use case is in blatant disregard for the regulations we operate under.
  - saulrh 8y ago
    Like I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular enough that access can be proposed, vetted, authorized, controlled, and monitored at the level of individual build numbers of individual binaries. I'd guess that the casual assumption was that there'd be a "defined use case" step but that it'd be covered by existing internal procedures, and I'd also guess that in any sane world it would be covered. (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)
    - vageli 8y ago
      > (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.) So you're saying a valid use case to access patient data under HIPAA is for debugging the product? That sounds incredibly unlikely; even at my job we use faked data for this kind of thing. Can you point me to a source for your claim?
ikiris 8y ago
Having worked on both sides of this, I find this account unlikely at best. If anything, the medical side is generally a horror show, especially at physician owned groups.
scarejunba 8y ago
British hospitals have already given them the data. They didn’t even have to pay. Some of the data is annotated meaning if you wanted supervised learning data it’s primo stuff. All free.

jchw 8y ago

...Google definitely understands how HIPAA works. GCP and G Suite both have HIPAA compliance to varying degrees. I don't think that person had any chance of getting clearance to do that from the G side, less your side.

snuxoll 8y ago
From a G Suite / GCP point of view they really only have to worry about the HIPAA Security Rule, most of which can be punted off on the client (they need to audit and control access to the platform, proper breach notifications and a BAA - the rest is mostly up to the client). Collecting patient health records starts bringing the HIPAA Privacy Rule into play, which they have zero experience with.
- jchw 8y ago
  Fair enough, but the other statement I still stand by: I don't think that deal would've been signed off on regardless. My impression from working here is that pretty much any use of any data goes through a fairly rigorous review process. I'm sure there was a point in time when that wasn't the case, but today it sure seems to be.
Sylos 8y ago
If the guy is high enough up in the hierarchy, there's a good chance that he can sign off on even illegal things. Looking at how Google is handling the GDPR, for example, there's just as well plenty obvious violations that someone had to sign off on and that are gonna cost them a few billions once they can't drag the lawsuits out any longer. In the meantime, though, they're very likely making enough money to offset that, which is why executives can sign off on illegal things in the first place. It's just a basic risk analysis in the end.
- jchw 8y ago
  I only take objection to the idea that because one employee in a company made a proposal that was not legal, that this is somehow representative of a company is ran. Engineers aren't lawyers, that's why there's a process for them to speak to lawyers in any sane large company, usually requiring approval for things that are especially important like handling sensitive data. Google isn't even special here.

saulrh 8y ago

You know what the really stupid thing is? Looking at the attack surfaces and data values and compromise histories, and having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat. If you're saying that Google would need to learn about a brand new truckload of paperwork, sure. But HIPAA is neither necessary nor sufficient for privacy or security.

snuxoll 8y ago
The problem is HIPAA doesn't allow one to share data without a reason - in fact it's only to be ACCESSED with a reason even by those with privileges to do so. I would trust Google to keep data safe, but brazenly asking for data without a defined use case is in blatant disregard for the regulations we operate under.
- saulrh 8y ago
  Like I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular enough that access can be proposed, vetted, authorized, controlled, and monitored at the level of individual build numbers of individual binaries. I'd guess that the casual assumption was that there'd be a "defined use case" step but that it'd be covered by existing internal procedures, and I'd also guess that in any sane world it would be covered. (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)
  - vageli 8y ago
    > (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.) So you're saying a valid use case to access patient data under HIPAA is for debugging the product? That sounds incredibly unlikely; even at my job we use faked data for this kind of thing. Can you point me to a source for your claim?

ikiris 8y ago

Having worked on both sides of this, I find this account unlikely at best. If anything, the medical side is generally a horror show, especially at physician owned groups.

scarejunba 8y ago

British hospitals have already given them the data. They didn’t even have to pay. Some of the data is annotated meaning if you wanted supervised learning data it’s primo stuff. All free.