4 ms·

"A series of federal data privacy crackdowns is complicating how health care companies market their services online." Surprised this is the lede. Seems the big

"A series of federal data privacy crackdowns is complicating how health care companies market their services online." Surprised this is the lede. Seems the biggest news is "problematic and widespread" "telehealth companies...violating their customers’ privacy"

zdragnar 3y ago
Anyone who isn't in health doesn't need to be HIPAA compliant, and thus isn't likely to do so. That means that pretty much every possible service that is commonly used is off-limits. JIRA is an especially frustrating, but not entirely uncommon, example: to get them to sign a BAA, you need a massive contact. That means no bug reports can go into JIRA with anything resembling the actual bug other than very vague info, so your internal customers (i.e. clinicians and customer service) have to jump through extra hoops just to file an issue. I would love a world where HIPAA level compliance was standard for all PII across all industries. Until then, people will keep making mistakes. Imagine this: you have two websites, a marketing site and a separate subdomain for your actual "app". There's a login button on the marketing site that redirects the user to the subdomain login page. Marketing adds GA to the marketing site to track conversations. Congratulations! You've just violated HIPAA, because the rules apply to "past, current and future users" meaning that Google could theoretically identify people who were interested in either creating an account or wanted to log into your website. "But our company has a BAA with Google! We use all sorts of their products, right?" Wrong! Analytics is the one essential business software that Google refuses to cover with a BAA, which alone should tell you why you ought never browse the internet without uorigin and co. I'm not making excuses for anyone. This is really important stuff to understand. It's also not always entirely obvious just exactly how leaky the entire SAAS world is to business people making what, in any other job, are obvious decisions.
- nradov 3y ago
  In my experience working on healthcare products, tools like Jira where you can't store PHI don't present serious obstacles. Usually you can document the steps to reproduce a defect using fake data. You're going to need it anyway for the automated test script to close the defect. And if you do need PHI at some stage of the process you can link to it from the Jira issue instead of storing it in Jira directly.
  - zdragnar 3y ago
    Alas, the mere possibility of accidentally adding too much info into a help ticket by support staff alone is enough to have the company insist we use something else.
    - jollofricepeas 3y ago
      Its simple. You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring. Each record gets a UUID. Everywhere else you reference that record by UUID. - Patient ABC123 called and requested modifications to their record - Meds delivered to ABC123 - Insurance confirmed for patient ABC123 That’s how you ensure MINIMUM NECESSARY. And if you want to go crazy there’s literally a crosswalk document published by HHS OCR and NIST: https://www.hhs.gov/hipaa/for-professionals/security/nist-security-hipaa-crosswalk/index.html https://www.hhs.gov/hipaa/for-professionals/security/nist-se...
      - twunde 3y ago
        For systems you control, yes even if what you've described takes a fair amount of work to get to. The main issue is that for software that wasn't built healthcare first, the strict privacy wasn't a requirement. Retrofitting your software and workflows can be a hell of a lot of work. Add in that you now need to verify that all the vendors you use are also compliant with the terms of your BAA. For most non healthcare first SAAS providers you either do a major rebuild or you end up with a healthcare specific cluster which is missing some of your tools (although it's worth pointing out that many more vendors particularly in the observability space are now HIPAA compliant.)
        jollofricepeas 3y ago
        Good point. HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them. Mature vendors just don’t want to abide by breach notification guidelines which is why they use it as leverage to ask for more $$$.

zdragnar 3y ago

Anyone who isn't in health doesn't need to be HIPAA compliant, and thus isn't likely to do so. That means that pretty much every possible service that is commonly used is off-limits. JIRA is an especially frustrating, but not entirely uncommon, example: to get them to sign a BAA, you need a massive contact. That means no bug reports can go into JIRA with anything resembling the actual bug other than very vague info, so your internal customers (i.e. clinicians and customer service) have to jump through extra hoops just to file an issue. I would love a world where HIPAA level compliance was standard for all PII across all industries. Until then, people will keep making mistakes. Imagine this: you have two websites, a marketing site and a separate subdomain for your actual "app". There's a login button on the marketing site that redirects the user to the subdomain login page. Marketing adds GA to the marketing site to track conversations. Congratulations! You've just violated HIPAA, because the rules apply to "past, current and future users" meaning that Google could theoretically identify people who were interested in either creating an account or wanted to log into your website. "But our company has a BAA with Google! We use all sorts of their products, right?" Wrong! Analytics is the one essential business software that Google refuses to cover with a BAA, which alone should tell you why you ought never browse the internet without uorigin and co. I'm not making excuses for anyone. This is really important stuff to understand. It's also not always entirely obvious just exactly how leaky the entire SAAS world is to business people making what, in any other job, are obvious decisions.

nradov 3y ago
In my experience working on healthcare products, tools like Jira where you can't store PHI don't present serious obstacles. Usually you can document the steps to reproduce a defect using fake data. You're going to need it anyway for the automated test script to close the defect. And if you do need PHI at some stage of the process you can link to it from the Jira issue instead of storing it in Jira directly.
- zdragnar 3y ago
  Alas, the mere possibility of accidentally adding too much info into a help ticket by support staff alone is enough to have the company insist we use something else.
  - jollofricepeas 3y ago
    Its simple. You put your PHI in one place and you encrypt it. Add all of the obvious controls like authentication, access control and monitoring. Each record gets a UUID. Everywhere else you reference that record by UUID. - Patient ABC123 called and requested modifications to their record - Meds delivered to ABC123 - Insurance confirmed for patient ABC123 That’s how you ensure MINIMUM NECESSARY. And if you want to go crazy there’s literally a crosswalk document published by HHS OCR and NIST: https://www.hhs.gov/hipaa/for-professionals/security/nist-security-hipaa-crosswalk/index.html https://www.hhs.gov/hipaa/for-professionals/security/nist-se...
    - twunde 3y ago
      For systems you control, yes even if what you've described takes a fair amount of work to get to. The main issue is that for software that wasn't built healthcare first, the strict privacy wasn't a requirement. Retrofitting your software and workflows can be a hell of a lot of work. Add in that you now need to verify that all the vendors you use are also compliant with the terms of your BAA. For most non healthcare first SAAS providers you either do a major rebuild or you end up with a healthcare specific cluster which is missing some of your tools (although it's worth pointing out that many more vendors particularly in the observability space are now HIPAA compliant.)
      - jollofricepeas 3y ago
        Good point. HIPAA controls are pretty simple. I think any mature company (not startups) will have them or is working towards them. Mature vendors just don’t want to abide by breach notification guidelines which is why they use it as leverage to ask for more $$$.