4 ms·

Is Copilot HIPAA compliant? It sends data to the cloud, so if you paste PHI…

deleted 4y ago
[deleted]
lelandfe 4y ago
Not an answer to your overall question of compliance, but to the specific point: > Copilot for Business does not retain any telemetry or Code Snippets Data. https://docs.github.com/en/copilot/configuring-github-copilot/configuring-github-copilot-settings-on-githubcom#enabling-or-disabling-telemetry https://docs.github.com/en/copilot/configuring-github-copilo...
- the_duke 4y ago
  The key word being "retain". It's probably still sent to their servers.
- ilc 4y ago
  And if that page changes without notifying you? ... Unless they are selling the compliance as a feature, be careful.
  - dx034 4y ago
    As long as it's part of the agreement, they would need to at least notify you if they're planning to change that.
ilc 4y ago
Source: Ex Hospital IT. I wouldn't risk it. It is too easy to write the wrong prompts and leak PHI. ChatGPT: "Write me a parser for this HL7 message..." Copilot: "Using this example message please write a parser for it..." Yeah... If it was compliant, people would write those in a heartbeat. Unless sold as HIPAA compliant, and the conditions of use for that compliance are known... don't trust it, for SAAS. This is stuff covered in your yearly HIPAA briefing folks.
- hn_throwaway_99 4y ago
  Realizing that many people still fundamentally misunderstand HIPAA and PHI: 1. First, you really only need to worry about the specifics of HIPAA if you are a "covered entity" under the law (primarily a hospital or other healthcare provider, or a health insurer), or if you have signed a BAA with another company (more on that below). There are all sorts of misunderstandings that you can't, for example, say something like "Jane couldn't make the meeting because she's out with the flu" at a company - that's not how it works. Unless you're a covered entity, you're under no obligation to keep PHI private under HIPAA. 2. If you do work at a HIPAA covered entity, it usually is made explicitly clear where patient data is or is not allowed. Even if GitHub Copilot were "HIPAA Compliant", unless they signed a HIPAA BAA (business associate agreement) with your company, it's still not OK to send them any PHI. Point being, there are plenty of reasons to be worried about customer privacy and data security, but people like to bring up HIPAA rules in lots of situations where they simply don't apply.
hn_throwaway_99 4y ago
Why on earth would you ever put any PHI information in source control?
- rectang 4y ago
  I would not. I avoid pasting PHI into source controlled files altogether.

deleted 4y ago

[deleted]

Not an answer to your overall question of compliance, but to the specific point: > Copilot for Business does not retain any telemetry or Code Snippets Data. https://docs.github.com/en/copilot/configuring-github-copilot/configuring-github-copilot-settings-on-githubcom#enabling-or-disabling-telemetry https://docs.github.com/en/copilot/configuring-github-copilo...

the_duke 4y ago
The key word being "retain". It's probably still sent to their servers.
ilc 4y ago
And if that page changes without notifying you? ... Unless they are selling the compliance as a feature, be careful.
- dx034 4y ago
  As long as it's part of the agreement, they would need to at least notify you if they're planning to change that.

ilc 4y ago

Source: Ex Hospital IT. I wouldn't risk it. It is too easy to write the wrong prompts and leak PHI. ChatGPT: "Write me a parser for this HL7 message..." Copilot: "Using this example message please write a parser for it..." Yeah... If it was compliant, people would write those in a heartbeat. Unless sold as HIPAA compliant, and the conditions of use for that compliance are known... don't trust it, for SAAS. This is stuff covered in your yearly HIPAA briefing folks.

hn_throwaway_99 4y ago
Realizing that many people still fundamentally misunderstand HIPAA and PHI: 1. First, you really only need to worry about the specifics of HIPAA if you are a "covered entity" under the law (primarily a hospital or other healthcare provider, or a health insurer), or if you have signed a BAA with another company (more on that below). There are all sorts of misunderstandings that you can't, for example, say something like "Jane couldn't make the meeting because she's out with the flu" at a company - that's not how it works. Unless you're a covered entity, you're under no obligation to keep PHI private under HIPAA. 2. If you do work at a HIPAA covered entity, it usually is made explicitly clear where patient data is or is not allowed. Even if GitHub Copilot were "HIPAA Compliant", unless they signed a HIPAA BAA (business associate agreement) with your company, it's still not OK to send them any PHI. Point being, there are plenty of reasons to be worried about customer privacy and data security, but people like to bring up HIPAA rules in lots of situations where they simply don't apply.

hn_throwaway_99 4y ago

Why on earth would you ever put any PHI information in source control?

rectang 4y ago
I would not. I avoid pasting PHI into source controlled files altogether.