6 ms·

I feel uncomfortable knowing doctor would use anything like this. How are 2 party consent states handled? Is this HIPPA compliant?

by avgDev 4y ago

jimnotgym 4y ago
Imagine a doctor instead mumbled his notes in a non native accent into a dictation machine, and had someone on minimum wage type them up?
- avgDev 4y ago
  Um there is dictation tools which are HIPPA compliant?
  - sp332 4y ago
    Of course, medical dictation is a whole industry. https://www.bls.gov/ooh/Healthcare/Medical-transcriptionists.htm https://www.bls.gov/ooh/Healthcare/Medical-transcriptionists...
- shagie 4y ago
  That job is known as a medical scribe. https://www.scribeamerica.com/what-is-a-medical-scribe/ https://www.scribeamerica.com/what-is-a-medical-scribe/ > A Medical Scribe is a revolutionary concept in modern medicine. Traditionally, a physician's job has been focusing solely on direct patient contact and care. However, the advent of the Electronic Health Record (EHR) created an overload of documentation and clerical responsibilities that slows physicians down and pulls them away from actual patient care. To relieve the documentation overload, physicians across the country are turning to Medical Scribe services. > A Medical Scribe is essentially a personal assistant to the physician; performing documentation in the EHR, gathering information for the patient's visit, and partnering with the physician to deliver the pinnacle of efficient patient care.
moomoo11 4y ago
HIPAA only applies to healthcare providers I think. Private companies like the extension maker can do whatever they want. At least that’s what someone on the internet told me and maybe it’s wrong.
- ceejayoz 4y ago
  If the provider wants to use the extension for patient care, the extension maker must be prepared to enter into an agreement to comply with the HIPAA rules. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information.
- avgDev 4y ago
  No. HIPPA applies to software as the software company would be considered a business associate. "If you handle, store or transmit protected health information (PHI) to or from a covered entity then you need to be HIPAA compliant." Source: https://github.com/truevault/hipaa-compliance-developers-guide https://github.com/truevault/hipaa-compliance-developers-gui...
  - JohnFen 4y ago
    This is not so clear-cut, though. There is a lot of gray area and doubt about this. HIPAA is not as complete protection as people think, and there are many situations where you'd think HIPAA would obviously apply, but it doesn't.
  - SkyPuncher 4y ago
    Business associate only comes into play when you're working with a covered entity. And, covered entities are far less inclusive than most people think. ---- The posted software is absolutely free to be non-HIPAA compliant. They're not a covered entity and without a relationship with a covered entity, they're not a business associate. However, without a relationship with a covered entity, they're also unlikely to generate any meaningful revenue.
rkaregaran 4y ago
This! No mention of HIPAA on their site at all. Would be a total non-starter for any providers not in private practice.
- shagie 4y ago
  Their website seems to suggest it is a French company with a US office. The issues around HIPAA would not be there and instead replaced by GDPR. The blog posts also mention French trained ML. > Cedille is a new open source French language model created by Coteries. It is trained to understand and write French and is also the largest model of its kind for French. Cedille is trained using large databases of publicly available content on the internet filtered for toxic content. Expanding into the US, yes - they would need to deal with HIPAA, but until they do they likely don't need to.
- freshpots 4y ago
  From their main page (https://www.nabla.com/ https://www.nabla.com/), the mention HIPAA: Secure and HIPAA-eligible Audio, transcripts, and notes are not stored by Nabla HIPAA-eligible and GDPR compliant SOC 2 and ISO 27001 certifications in progress Digging deeper (https://www.nabla.com/blog/privacy-security/ https://www.nabla.com/blog/privacy-security/): This data processing is done on Nabla's servers, which are powered by the HIPAA and GDPR compliant Google Cloud Platform (GCP), and on HIPAA-eligible LLM servers.
  - JohnFen 4y ago
    What does "HIPAA-eligible" mean? EDIT: I was very curious about this and did a bit of research. The answer to it is squishy. It seems to be mostly a marketing term. The best definition I found was this: "A service that is HIPAA eligible is one that is capable of being configured in a way that could meet HIPAA compliance requirements, but you have to know how to do it, it doesn’t happen ‘out of the box.’" https://www.cleardata.com/articles/hipaa-eligible-hipaa-compliant-services/ https://www.cleardata.com/articles/hipaa-eligible-hipaa-comp... So it sounds great but doesn't actually mean that much.
    - 4y ago

I feel uncomfortable knowing doctor would use anything like this. How are 2 party consent states handled? Is this HIPPA compliant?

by avgDev 4y ago

I feel uncomfortable knowing doctor would use anything like this. How are 2 party consent states handled? Is this HIPPA compliant?

jimnotgym 4y ago

Imagine a doctor instead mumbled his notes in a non native accent into a dictation machine, and had someone on minimum wage type them up?

avgDev 4y ago
Um there is dictation tools which are HIPPA compliant?
- sp332 4y ago
  Of course, medical dictation is a whole industry. https://www.bls.gov/ooh/Healthcare/Medical-transcriptionists.htm https://www.bls.gov/ooh/Healthcare/Medical-transcriptionists...
shagie 4y ago
That job is known as a medical scribe. https://www.scribeamerica.com/what-is-a-medical-scribe/ https://www.scribeamerica.com/what-is-a-medical-scribe/ > A Medical Scribe is a revolutionary concept in modern medicine. Traditionally, a physician's job has been focusing solely on direct patient contact and care. However, the advent of the Electronic Health Record (EHR) created an overload of documentation and clerical responsibilities that slows physicians down and pulls them away from actual patient care. To relieve the documentation overload, physicians across the country are turning to Medical Scribe services. > A Medical Scribe is essentially a personal assistant to the physician; performing documentation in the EHR, gathering information for the patient's visit, and partnering with the physician to deliver the pinnacle of efficient patient care.

moomoo11 4y ago

HIPAA only applies to healthcare providers I think. Private companies like the extension maker can do whatever they want. At least that’s what someone on the internet told me and maybe it’s wrong.

ceejayoz 4y ago
If the provider wants to use the extension for patient care, the extension maker must be prepared to enter into an agreement to comply with the HIPAA rules. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities... > If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information.
avgDev 4y ago
No. HIPPA applies to software as the software company would be considered a business associate. "If you handle, store or transmit protected health information (PHI) to or from a covered entity then you need to be HIPAA compliant." Source: https://github.com/truevault/hipaa-compliance-developers-guide https://github.com/truevault/hipaa-compliance-developers-gui...
- JohnFen 4y ago
  This is not so clear-cut, though. There is a lot of gray area and doubt about this. HIPAA is not as complete protection as people think, and there are many situations where you'd think HIPAA would obviously apply, but it doesn't.
- SkyPuncher 4y ago
  Business associate only comes into play when you're working with a covered entity. And, covered entities are far less inclusive than most people think. ---- The posted software is absolutely free to be non-HIPAA compliant. They're not a covered entity and without a relationship with a covered entity, they're not a business associate. However, without a relationship with a covered entity, they're also unlikely to generate any meaningful revenue.

rkaregaran 4y ago

This! No mention of HIPAA on their site at all. Would be a total non-starter for any providers not in private practice.

shagie 4y ago
Their website seems to suggest it is a French company with a US office. The issues around HIPAA would not be there and instead replaced by GDPR. The blog posts also mention French trained ML. > Cedille is a new open source French language model created by Coteries. It is trained to understand and write French and is also the largest model of its kind for French. Cedille is trained using large databases of publicly available content on the internet filtered for toxic content. Expanding into the US, yes - they would need to deal with HIPAA, but until they do they likely don't need to.
freshpots 4y ago
From their main page (https://www.nabla.com/ https://www.nabla.com/), the mention HIPAA: Secure and HIPAA-eligible Audio, transcripts, and notes are not stored by Nabla HIPAA-eligible and GDPR compliant SOC 2 and ISO 27001 certifications in progress Digging deeper (https://www.nabla.com/blog/privacy-security/ https://www.nabla.com/blog/privacy-security/): This data processing is done on Nabla's servers, which are powered by the HIPAA and GDPR compliant Google Cloud Platform (GCP), and on HIPAA-eligible LLM servers.
- JohnFen 4y ago
  What does "HIPAA-eligible" mean? EDIT: I was very curious about this and did a bit of research. The answer to it is squishy. It seems to be mostly a marketing term. The best definition I found was this: "A service that is HIPAA eligible is one that is capable of being configured in a way that could meet HIPAA compliance requirements, but you have to know how to do it, it doesn’t happen ‘out of the box.’" https://www.cleardata.com/articles/hipaa-eligible-hipaa-compliant-services/ https://www.cleardata.com/articles/hipaa-eligible-hipaa-comp... So it sounds great but doesn't actually mean that much.
  - 4y ago