3 ms·
From a G Suite / GCP point of view they really only have to worry about the HIPAA Security Rule, most of which can be punted off on the client (they need to aud
by snuxoll 8y ago
From a G Suite / GCP point of view they really only have to worry about the HIPAA Security Rule, most of which can be punted off on the client (they need to audit and control access to the platform, proper breach notifications and a BAA - the rest is mostly up to the client).
Collecting patient health records starts bringing the HIPAA Privacy Rule into play, which they have zero experience with.
- jchw 8y agoFair enough, but the other statement I still stand by: I don't think that deal would've been signed off on regardless. My impression from working here is that pretty much any use of any data goes through a fairly rigorous review process. I'm sure there was a point in time when that wasn't the case, but today it sure seems to be.