3 ms·
Wow, we handle PHI and this is absolutely not acceptable. Glad we're not using New Relic but I'm terrified of Datadog doing this in the future.
by tapoxi 5y ago
Wow, we handle PHI and this is absolutely not acceptable. Glad we're not using New Relic but I'm terrified of Datadog doing this in the future.
- WkndTriathlete 5y agoPHI must only be collected on platforms that are certified for PHI. Collection PHI on platforms not certified for PHI is a HIPAA violation and a good way to get sued for all of your dollars x10, as well as criminal proceedings. Fully-anonymized PHI can be analyzed on anything but the anonymization process must also be certified to have a reasonably low risk of re-identification when combined with other (arbitrary) datasets. (source: I used to implement and certify PHI data collection platforms.)
- dragonwriter 5y ago> Collection PHI on platforms not certified for PHI is a HIPAA violation No, it's not. (There are compliance reauirements, both direct and implicit on the HITECH definition of secured PHI, but “certified for PHI” is not one of them, despite marketing myths spread by the private HIPAA certification industry, which pedals certifications without legal meaning.) > a good way to get sued for all of your dollars x10, HIPAA penalties are capped at a penalty of $1.5 million per year for violations of any single provision, regardless of number of violations (and $50k per violation).
- draebek 5y agoFor the record, I believe extreme violations of HIPAA can result in criminal charges, or so I've read. (Accidentally sending PHI to New Relic almost certainly does not qualify for jail time.)
- heavyset_go 5y agoMost companies that deal with PHI are not covered entities, or their partners, that HIPAA restrictions apply to.
- draav 5y agoI don't see how this would happen with Datadog. Their agent already has logging capabilities but you have to explicitly enable it