3 ms·

>having someone else be partially liable for HIPAA compliance is a godsend.... That's not what this is, you still have 100% liability for any data that touches

>having someone else be partially liable for HIPAA compliance is a godsend.... That's not what this is, you still have 100% liability for any data that touches your software or is on your servers. (Any lawyer will tell you that liability, particularly the egregious, criminal kind, cannot be contracted away in the United States.) What Google is saying is that for some of its APIs, the data you send will be operated on in a HIPAA compliant environment. But understand that if Google's HIPAA environment somehow fails in an egregious manner, you would still be liable. All that said, the likelihood of the failure being on Google's end is remote, in the extreme. If there is a failure, it's far more likely to be on your side. In your servers where you hold the data, or where the data is being processed by you, or maybe you displayed the data to someone you shouldn't have or something like that. Very unlikely to be Google given the, I believe intentionally, limited touchpoints they have on the data.

gravypod 8y ago
I'm primarily talking about how their services seem to manage persistence for you. They also seem to have some tool for anonimization of PII and setting up VPN integrations.
markolschesky 8y ago
It's not necessarily liability, but it is shared responsibility. Someone validating that they will take responsibility for parts of your stack can be very important, especially at scale.
snuxoll 8y ago
If you are accepting liability as a HIPAA business associate you have done something tremendously stupid in your BAA. HIPAA business associates only face direct liability for violating the security rule, improper breach notification, misuse of PHI, etc. As a HIPAA covered entity you are still on the hook for everything else - if your cloud provider has a breach and you can identify that N records were accessed you still get the fine, unless your BA put some sort of liability transfer in the agreement (legal will not be OK with this, so I’m betting not).

gravypod 8y ago

I'm primarily talking about how their services seem to manage persistence for you. They also seem to have some tool for anonimization of PII and setting up VPN integrations.

markolschesky 8y ago

It's not necessarily liability, but it is shared responsibility. Someone validating that they will take responsibility for parts of your stack can be very important, especially at scale.

snuxoll 8y ago

If you are accepting liability as a HIPAA business associate you have done something tremendously stupid in your BAA. HIPAA business associates only face direct liability for violating the security rule, improper breach notification, misuse of PHI, etc. As a HIPAA covered entity you are still on the hook for everything else - if your cloud provider has a breach and you can identify that N records were accessed you still get the fine, unless your BA put some sort of liability transfer in the agreement (legal will not be OK with this, so I’m betting not).