19 ms·

Launch HN: Delve (YC W24) – HIPAA compliance as a service

111 points by selinkocalar 3y ago

Hey, HN! We're Karun and Selin, co-founders of Delve (https://getdelve.com https://getdelve.com). We help companies get HIPAA compliant fast, with 1-click infrastructure, streamlined legal policies, and real-time monitoring. Here’s a quick demo: https://youtu.be/mQbb5mprsUA https://youtu.be/mQbb5mprsUA. HIPAA is a US federal law passed back in 1996 that sets standards for protecting sensitive health information. Here’s an article that breaks it down pretty simply: https://www.getdelve.com/blog/quick-guide-to-hipaa https://www.getdelve.com/blog/quick-guide-to-hipaa. Most companies that process health information in the US need to become HIPAA compliant, a process that can be long and expensive. At our previous health tech company, we spent 6 weeks (and tens of thousands of dollars) on getting compliant. We had to complete a lot of manual work, even after purchasing an industry-standard compliance solution, and felt like we were hitting checkboxes with little confidence in our security. We realized that many parts of the compliance process could be streamlined and simplified, which led us to building Delve. To get HIPAA compliant, you need (1) secure infrastructure, (2) legal policies, and (3) logging/monitoring. At Delve, we help startups with all three. We provide 1-click HIPAA compliant infrastructure deployed in your cloud and a CI/CD pipeline to update infrastructure from git push (think Heroku but HIPAA compliant). Then, we provide legal policies, paperwork, and a complete task list customized to your infrastructure setup. Finally, we have a real-time monitoring dashboard to help oversee compliance, track system activity, and review logs. One thing we noticed the first time we ever got HIPAA compliant was that we had to use many tools along the way. We bought an industry-standard HIPAA compliance solution, hired a HIPAA DevOps contractor to help configure secure infrastructure, and worked with lawyers to adapt the boilerplate legal policies that our compliance solution had provided. When building Delve, we worked hard to give you everything you need in one place, reducing the hassle and cost. We currently charge on an annual flat-fee basis. However, we’re still exploring our pricing model (flat-fee vs. usage-based vs. combination of both), and if you have any thoughts to share on that, we’d love to hear them. We’re really excited about making it easier to build in healthcare and removing compliance bottlenecks. Thrilled to share this with you and hear your comments!

igcbsgd 3y ago
[dead]
rposborne 3y ago
How do you beat https://www.aptible.com/ https://www.aptible.com/?
- deleted 3y ago
  [deleted]
- selinkocalar 3y ago
  Great question! Aptible is great for deploying HIPAA-compliant applications, but you still have to purchase another solution for completing the legal policies and compliance checklist, such as Vanta. Think of us like Aptible + Vanta. Because you deploy your application through us, we can give you deep insights into your security and compliance. For example, we give you legal policies that have already been customized to your infrastructure setup. Similarly, we provide a logging/monitoring dashboard that is designed to meet what auditors look for in your infrastructure setup. Putting all your compliance solutions in one place lets us streamline the path to compliance.
  - fancyremarker 3y ago
    Hi! Aptible founder here. I wanted to make an important correction here. Aptible has a built-in Security & Compliance Dashboard [0] that supports compliance automation and reporting (PDF and API exports) for HIPAA, HITRUST and other security frameworks. You can see a demo of the entire platform, including this Dashboard, in our "Aptible in 10 Minutes" video. [1] You can also integrate Aptible with Vanta, Drata or another compliance automation tool, if you're running the self-hosted version of Aptible that runs in your own AWS account. If you do, you can expect fully passing tests for HIPAA and SOC 2 in Vanta or Drata with zero additional configuration. Most Aptible customers find our built-in dashboard sufficient, and don't feel the need to buy Vanta/Drata separately to ensure HIPAA compliance. [0] https://www.aptible.com/docs/intro-compliance-dashboard https://www.aptible.com/docs/intro-compliance-dashboard [1] https://www.youtube.com/watch?v=mhNzGO9KbWY https://www.youtube.com/watch?v=mhNzGO9KbWY
    - selinkocalar 3y ago
iends 3y ago
I didn't see the mention of BAAs anywhere. Do you handle getting that signed with vendors like AWS?
- selinkocalar 3y ago
  Yes! We outline BAA requirements in our compliance checklist (i.e. we'll provide the exact steps of how to get a BAA with AWS and remind you to get BAAs with other 3rd parties). We're also building out a small network of 3rd party vendors that we work closely with to help our customers get BAAs signed quick and offer discounts to those 3rd parties' services.
  - candiddevmike 3y ago
    Do you enter into a BAA with all of your customers?
    - selinkocalar 3y ago
      Yes, we sign sub-BAAs with our customers.
debarshri 3y ago
Every org that starts out with an compliance oriented SaaS in my experience ends up migrating out of it eventually because when they grow - they have more capital to build their own infrastructure as hire more engineers who do not want to deal with kinks of a SaaS abstraction. If you are using Vanta or Drata at early staging and opt for HIPAA framework, you do get the list of controls that you have to implement that also include cloud specific configuration changes that you need to do. And these changes are one time thing, continuously monitored by the framework. My argument is that, the target market you trying sell - early stage HIPAA compliance market is not difficult anymore. I hope this feedback helps you to foresee possible problems.
- selinkocalar 3y ago
  Thanks for the transparency and thoughts on this! We provide a lot of active elements, such as our infrastructure logging/monitoring dashboard, email alerts, and code vulnerability scans every time you git push, so that we aren't just a one-time purchase. We help you be proactive about preventing breaches instead of just integrating with your AWS API and passively monitoring. One of the biggest things about HIPAA is that it isn't just your initial setup that matters, it's how you manage compliance on an ongoing basis that's important for maintaining security and privacy. We're also growing with our customers and moving upstream, and keeping in mind exactly what you said about preventing SaaS churn. As we do this, we're following the core thesis that compliance should bridge legal, DevOps, and cybersecurity, and when you combine all these you can get much deeper insights into security and can integrate deeper within an organization to provide more proactive measures.
  - debarshri 3y ago
    Solutions like this wont work in large orgs that have lead to huge ACVs. Would be more happy if you prove me wrong.
    - throwkjkbkljbk 3y ago
      No you're right for sure. Aptible is mentioned a few commends down, and is/was basically the same business (compliance focused hosting for small startups). Now Aptible has seemingly pivoted away from that focus and are now trying to compete in the PaaS space. There are a couple of obvious reasons here. 1. You're limiting your TAM to just healthcare startups. Why? 2. After not that long, it doesn't make financial sense for your customers to stick with you. I speak from experience on this one having moved some number of customers off of Aptible in the past. Aptible was charging 10X AWS for a pretty thin wrapper around AWS. At any kind of scale beyond a handful of machines it makes sense to just bite the bullet and hire a devsecops person, who in the end will do more for you. My advice here is to think bigger. Think about what value the GRC/Security/DevOps teams of bigger orgs are delivering and how you could displace (some) of them.
ramzez 3y ago
is there pricing information?
- selinkocalar 3y ago
  We charge a fixed annual fee — zero usage-based costs. We deploy all on your own AWS cloud so you're not paying any marked up fees or being faced with surprise bills. If you have any thoughts on this would love to hear them!
  - Sephr 3y ago
    Can you provide any numerical information regarding the pricing of your service? e.g. Variable pricing thresholds, target ICP budget, and service tiers are all relevant information here.
- btoro 3y ago
  I'd also like to see pricing info available.
a_gnostic 3y ago
It does more than just protecting sensitive health information, it also governs how billing works, so if you've ever wondered why some Dr. you never met is sending you bills in the thousands of dollars; HIPAA is where you can find out why!
- selinkocalar 3y ago
  Yes! HIPAA was initially rolled out for the portability and continuity of health insurance coverage. But over the years, with the enactment of the Privacy Rule, Security Rule, HITECH Act, Omnibus Rule, etc., HIPAA's implications have been shaped quite a bit.
- a_gnostic 3y ago
  Spoiler: Anyone who touches the patient, anyone who has a conversation with the patient, anyone who measures stuff of the patient, doctors consulted by doctors also get to charge. So that's why suddenly every nurse wants to talk to you, check your blood pressure, and a different nurse wants your blood oxygenation… and that guy that walked by who greeted the doctor seeing you, and talked about how much the 49ers sucked last weekend, and flirted with the nurse? Bill's in the mail.
  - SkyPuncher 3y ago
    No, that is not at all why. There are avenues for billing via consult (eg doc to doc conversations), but what you claim is very far from the truth.
johnxie 3y ago
Very cool! Is there an equivalent for SOC2, GDPR, etc...?
- selinkocalar 3y ago
  We're rolling out SOC2 in a month! GDPR, HITRUST, etc. are down the line.
candiddevmike 3y ago
How does this compare to OneTrust and Tugboat?
- selinkocalar 3y ago
  Of course! Tugboat by OneTrust provides compliance checklist and preparation tools (i.e. InfoSec policies, audit management, controls mappings). We provide a similar compliance checklist/preparation tool to Tugboat, as well as HIPAA-compliant infrastructure and technical configurations. We’ll set up your application on compliant infrastructure deployed in your cloud, integrate CI/CD pipelines, and provide real-time logging/monitoring. Providing the technical piece that's compliant out of the box lets you save weeks of manual work configuring it yourself. By covering you not only on an administrative/compliance front, but also on a technical/cybersecurity front, we help you actively enforce good security and monitor compliance comprehensively.
fishpen0 3y ago
We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are all AWS-centric
- technics256 3y ago
  Interesting, haven't heard of this. Always figured aws and gcp were ahead of azure in terms of Healthcare
  - fishpen0 3y ago
    They are, so I want to smash my face in once a month or so when this boogeyman is dragged up out of hell during executive calls
  - robertlagrant 3y ago
    They're ahead technically, but, for example, Microsoft has its claws in a lot of the NHS in the UK.
  - kstrauser 3y ago
    AWS is fine for building out HIPAA services. They have a decent portal at https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/ explaining their compliance, which services you can use, and how to get them to sign a Business Associate Agreement (BAA). I haven't done healthcare stuff in GCP or Azure so I can't compare, but AWS is _not_ a blocker for HIPAA.
    - FireBeyond 3y ago
      > I haven't done healthcare stuff in GCP My understanding is that Google will not agree to any of the liability provisions inherent to a BAA, no matter how large your size.
burnte 3y ago
Healthcare CIO/VP here. Some thoughts to help you improve your communication to potential customers, AKA what I look for when I am evaluating a platform for healthcare use: The website is too thin, it looks like you're really heavily relying on meetings to get customers rather than the product itself. I think you should dedicate some resources to fleshing out the website A LOT with more information because it actually looks like a potentially useful product, but I'm not going to commit to a presentation just for more info. This is a red flag, as in my experience companies with little public info and who want to share everything in demos/meetings have a lot of warts they try to hide by a highly curated meeting experience. Cancel the blog portion, it's 2024 and no one cares about company blogs. No one ever DID, but they were popular for a hot minute anyway, and that minute is gone. Don't blog and take that time to flesh out the website dramatically. Right now your sole blog post is a 2 minute intro to HIPAA. Anyone who doesn't know what HIPAA is will not be a customer, so this post isn't helping you at all. I think your #1 priority this week should be flooding the website with information about the product. How-To guides, detailed descriptions of features, videos, even an interactive demo would be great. I'm not sure if your product is narrow and focused on helping code compliant apps, or if you're a general compliance checklist suite. The latter is WAY more useful than the former. If you're the former, I'd suggest expanding your scope to get more business. when I thought this was an enhanced HIPAA compliance suite, I was ready to get more info, now that I see it may be focused on app development only, I don't care about it, as honestly getting computers compliant is a lot easier than getting humans and processes compliant. If you're not just focused on development, this reinforces the website problem. Kill your FAQ: "How is Delve different?" Please flesh this out to about 1,000-1,500 words on another page and go into more detail. "Has Delve been reviewed by HIPAA auditors?" Don't tell me, link me to your PDF compliance reports. "How do I know your infrastructure is secure?" Combine this with the question above and link me to your PDF compliance reports. Then make it it's own page like with the question above. "How can I show my customers that I’m HIPAA compliant?" Again, it's 2024, no one cares about badges, they want BAAs and compliance reports. People understand today that a little badge on a webpage means nothing. This isn't even a question you should be answering, actually. Only your customers can answer that through knowledge of their customer base. You look like a promising startup, I hope you accept this critique from a decision maker in your target audience in the spirit it's offered. It's not meant to say you're bad or dumb, you just need to spend some real time on the website and information shared with potential clients. Right now you look interesting, but not enough for me to reach out yet. A more detailed website would change that a lot.
afro88 3y ago
Looks great, and I wish this existed 2 years ago when I started building a HIPAA compliant product! But I immediately had a few questions and am hesitant to book a demo (I'm quite time poor): 1. What clouds do you support? 2. What does the infrastructure look like, what services does it use? 3. Do I get locked into a particular orchestration or deployment setup? We prefer k8s for example.
- selinkocalar 3y ago
  Thanks for the question! 1) We’ve made the conscious decision to start with AWS support, as our ICP is primarily on AWS (80%+). We plan to roll out GCP and Azure once we have sufficient coverage on AWS services. (2) When you’re onboarded, we deploy a series of base resources (IBNLT networking resources, notification services, logging services). You can then select from a library of supported resources for your application-specific environment. (3) To directly answer your question — no you are not locked in and can change as you see fit. Also, because we deploy infrastructure in your own cloud, you're able to go in anytime and make custom modifications to your infrastructure.
  - afro88 3y ago
    Many thanks for the answers. In reply to 3, can you clarify the details of what deployment snd orchestration tools you set up for your customers? And if we are able to make modifications to the underlying infra, is there some kind of process that prevents changes that break HIPAA compliance?
    - selinkocalar 3y ago
      Sure thing! Under the hood, we define infrastructure using Terraform to explicitly define logical relationships between resources, easily enforce deny by default behavior, and spin up resources with granular access logging by default. We then expose a subset of toggles that users can adjust (compute resources, service connections, silo’d application deployment). Some toggles that may have a business need, but would prove to carry excess risk (such as blanket public exposure of data store’s), are explicitly disallowed. This is a decision that we’ve made and feel offers the ideal balance between flexibility and compliance enforcement.
pierat 3y ago
Well that'll be a fun name change. Are you Delve , or Microsoft Delve? https://support.microsoft.com/en-us/office/what-is-delve-1315665a-c6af-4409-a28d-49f8916878ca https://support.microsoft.com/en-us/office/what-is-delve-131... Aside that, neat idea.
- selinkocalar 3y ago
  Ah, we're the other Delve - the one that doesn't come with an Office subscription but makes your office HIPAA compliant.
imglorp 3y ago
Sort of related: it seems like compliant providers and services are carrying the burden of patient privacy in good faith, securing the front door. Meanwhile, there are open tent flaps on the sides and back. It's hard to do the right thing while there are minimal regs and enforcement on the rest of the ecosystem. Eg, Tracking on medical sites let Meta go to town -- https://www.theverge.com/2022/8/2/23288612/meta-hosptials-sued-patient-privacy-facebook-data-hipaa https://www.theverge.com/2022/8/2/23288612/meta-hosptials-su... Eg, Patient data brokers: "Currently, under HIPAA there is no law prohibiting the use of healthcare data shared via marketing practices." -- https://www.beckershospitalreview.com/healthcare-information-technology/healthcare-data-for-sale-how-data-brokers-are-packing-selling-patient-data.html https://www.beckershospitalreview.com/healthcare-information...
- selinkocalar 3y ago
  Yes, you’re correct in your assertion that infrastructure policies are just one part of the puzzle. In conjunction with our preconfigured deployments, we provide customers a set of legal policies we’ve worked with former US Attorneys to closely align with the spirit of HIPAA enforcement. We’ve all seen the countless byteDance and Meta cookie data leakage headlines on insurance and healthcare portals, and provide customers with notice to remove trackers, or sign BAAs with user metrics companies where possible.
  - Sephr 3y ago
    > [we] provide customers with notice to remove trackers, or sign BAAs with user metrics companies where possible Do you provide any technical solutions to help your customers control these trackers in accordance with HIPAA and privacy laws, or do you refer your customers to third-party privacy solutions to accomplish this? You expressed disdain for "hitting checkboxes," yet your solutions to this specific problem appear to be more checkboxes. Asking customers to remove a tool from their site or request tool vendors to sign a contract is helpful, but it forces customers to make tough decisions: Do I lose revenue by completely removing a tool? Can I trust a vendor to follow their BAA? Technical compliance solutions can remove this source of uncertainty by directly controlling tracker behavior on a fine-grained level.
dekhn 3y ago
I remember early in Google Cloud I was working with a Google PM on health-related projects (Google Cloud Genomics). The PM was our ostensible expert on HIPAA, and explained many details (such as BAA). The one funny thing they said is "there is no such thing as HIPAA compliance, that term is meaningless". And I don't really understand what they meant, but I think they must have been wrong (even though they were supposed to be the subject matter expert).
- debarshri 3y ago
  You PM is right. Unlike SOC2, you dont get a certification. More details here [1] [1] https://compliancy-group.com/what-is-a-hipaa-certification/ https://compliancy-group.com/what-is-a-hipaa-certification/
  - dekhn 3y ago
    Maybe. But Google Cloud has adopted the compliance terminology: https://cloud.google.com/security/compliance/hipaa https://cloud.google.com/security/compliance/hipaa
  - kstrauser 3y ago
    However, if you want to do business with any reasonable size of healthcare org, you're eventually gonna have to get a HITRUST report.
    - selinkocalar 3y ago
      That's true. Curious what your experience has been with HITRUST
      - kstrauser 3y ago
        Layoffs caught me before we finished the audit so I can’t say with full confidence. However, if you have a SOC 2 type 2 report, you’re probably 90% of the way there. They’re not perfect overlaps but it’s more like a circle viewed with astigmatism than the Mastercard logo.
Aaronstotle 3y ago
Does this relate to HITRUST as well? I know the pain of those audits as I worked for healthcare companies that had them and a lot of the rules are similar.
- selinkocalar 3y ago
  It's slightly similar but HITRUST is still more comprehensive and is built on the CSF framework. HITRUST was initially developed as the answer to HIPAA compliance, although the framework has now been rebranded as industry-agnostic. Hence, there is a good amount of overlap as you mentioned.
stevenicr 3y ago
So this is for AWS style hosting, and there is no pricing info. I am interested in this and will be someone could be pitching this to many others, but I want it with cpanel cloud hosting not aws/git/whatever.
- selinkocalar 3y ago
  You’re correct, we are putting our engineering focus into designing an enjoyable experience with AWS as our launch pad, and broadening our supported cloud providers as we continue to build out. I’ve only seen and personally used CPanel for on-prem management (paired with WHMCS for billing), which is not something I’ve come across so far here. Happy to talk about this more though if you have time.
user3939382 3y ago
My 5 second reaction having managed a large organization in a compliance/regulatory driven environment is that these regulations need to be part of the orgs DNA or long term you’ll be buried by an audit. It’s not something you bolt on.
- selinkocalar 3y ago
  Yes, exactly. This is a similar battle IT folks face with implementing best practices with it comes to cyber hygiene, and the sooner it’s solidified, the better (shift left approach). That's been our current approach with helping early stage health tech startups, and will be a tough but rewarding battle as we move towards organizations with established practices (be it good or bad). Curious to talk more with you about this if you have time.
  - user3939382 3y ago
    Sure. My email is in profile.
hbcondo714 3y ago
> Most companies that process health information in the US need to become HIPAA compliant I appreciated what Delve is doing for these kind of companies but what about non-tech small companies & individual therapists that process health data? We enlist the services of multiple behavioral / mental health providers and most of them use personal devices / SMS / GMail for transmitting PHI[1]. I understand this may not be the target audience for Delve but getting these kind of companies HIPAA-compliant is a real need. [1] https://www.hhs.gov/answers/hipaa/what-is-phi/index.html https://www.hhs.gov/answers/hipaa/what-is-phi/index.html
- selinkocalar 3y ago
  It's an interesting point you raise. You're correct in that our current target audience primarily covers the companies that provide services to healthcare providers instead of actual healthcare providers. For more context, HIPAA breaks companies into two categories: (1) Covered Entities, which are healthcare providers, health plans, and healthcare clearinghouses, and (2) Business Associates, which are companies that process PHI on behalf of Covered Entities. Behavioral/mental health providers fall into the Covered Entity category, and their requirements under HIPAA are different than those of Business Associates. Our services are currently focused on supporting Business Associate needs.
  - fhsm 3y ago
    > … providers fall into the Covered Entity category … If doctor etc is a Covered Entity then that doctor is most likely a Provider, but is every doctor providing healthcare a really CE? I wouldn’t have said no but I don’t track it ultra closely so I’m curious what’s the latest? My first three results matched my expectation but they could easily be out of date… https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-covered-entity-if-you-dont-bill-electronically/ https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-co... https://www.stevenslee.com/health-law-observer-blog/is-a-cash-only-medical-practice-subject-to-hipaa/ https://www.stevenslee.com/health-law-observer-blog/is-a-cas... https://www.americares.org/wp-content/uploads/globalassets/_snc/eduresources/practicefacility/hipaa/2.-hipaa-faqs-may-2014.pdf https://www.americares.org/wp-content/uploads/globalassets/_... Anyway re the parent, my fourth result uses therapist as the example of uncovered providers, which would have been my guess https://www.consumerreports.org/health/health-privacy/guess-what-hipaa-isnt-a-medical-privacy-law-a2469399940/ https://www.consumerreports.org/health/health-privacy/guess-...
deleted 3y ago
[deleted]
eddywebs 3y ago
Congratulations on Launch! Would you be plan to expand to Salesforce platform ? I am Salesforce partner would love to connect if you looking for implementation partners.
- selinkocalar 3y ago
  Happy to chat further and learn more about what you were thinking, our Calendly is always open: https://calendly.com/getdelve/demo https://calendly.com/getdelve/demo
javiramos 3y ago
I wish a solution like this for ITAR compliance
- selinkocalar 3y ago
  If we're being honest ITAR is quite far from HIPAA - can't promise that we'll get to it anytime soon :)
zackify 3y ago
What if I want to use the service but keep my already hipaa compliant hosting platform?
- selinkocalar 3y ago
  Nice question. If you're using another platform to manage the infrastructure/hosting, you'd be able to integrate with us to complete the remaining parts necessary to get HIPAA compliant (i.e. the legal policies, compliance task list, risk assessments, vendor reviews, etc.). That being said, a lot of our customers prefer migrating over to our infrastructure because many hosting services charge high usage-based fees for HIPAA compliance and it ends up being cheaper to deploy straight onto AWS, where they can use their AWS credits, for their infrastructure management.
chevman 3y ago
So what you may have already discovered, is HIPAA compliance, HiTrust certification, BAAs, etc are table stakes for servicing covered entities in the healthcare space. They are all preludes, however, to agreeing to liability amounts/indemnification in the actual contract. This is why, as an example, most healthcare orgs end up moving away from Google. Google (to my knowledge, which includes large deals at F50 level), will not contractually agree to any kind of financial or legal liability for data breaches, hacks etc. Microsoft (and to a lesser extent Amazon) will agree to such terms if you're a big enough account, and generally already have some kind of framework in place with your procurement dept likely that simply needs to be amended. This is also why larger healthcare orgs are reticent to work with smaller, less well capitalized startups in the ecosystem. The liability alone should something go wrong would potentially vaporize your company, and would definitely lead to uncomfortable conversations with your investors (who maybe, might also have large holdings in the larger healthcare orgs and be incented to not do stupid things that would create massive liabilities!).
- cbg0 3y ago
  > This is also why larger healthcare orgs are reticent to work with smaller, less well capitalized startups in the ecosystem. The liability alone should something go wrong would potentially vaporize your company While this sounds very dramatic, aren't the "less well capitalized startups" in your scenario the ones responsible for their own HIPAA violations, and not the larger healthcare orgs?
  - fluidcruft 3y ago
    There's also the business risk that a company you depend on goes poof and you're left scrambling (scrambling doesn't work well in healthcare IT, so much of it is bespoke and barely working... projects that look like they should work routinely fail years later in at integration setting everything back three years... it's a mess).
- selinkocalar 3y ago
  Completely agreed. Trust and credibility are harder to prove for startups trying to contract to large health organizations, which is why a HIPAA compliance report or active monitoring from a 3rd party can be really helpful. Some large hospitals even turn away calls from startups for this exact reason. Compliance is table stakes. It's important to address HIPAA early and be able to attest to your compliance and security.
FireBeyond 3y ago
As someone who has been in healthcare IT for maybe 10 years, comfortable with HIPAA HITECH, SAS70, etc., one thing I took a pause at was: > Yes! HIPAA auditors have reviewed Delve to ensure that we cover HIPAA requirements. To me, the word 'review' is doing a bit of heavy lifting. There's a lot of self-attestation in the HIPAA world, a lot of policies and processes - but to my understanding (and forgive me if it is flawed), any actual auditing is on specific implementation, not generalized. I think your statement is accurate, to be clear - but I think the concern I had was that someone less nuanced or experienced might read something that isn't there into it - i.e. "our tooling has been audited". (Mind you, I also think that someone "less nuanced or experienced" probably shouldn't be heading up a PHI solution, so maybe self-selecting). Also: > Our infrastructure has been vetted by cybersecurity and DevOps experts from AWS, Google Cloud, and more. Similarly, this heavily implies that AWS has done some attestation on your product, which I doubt. For one, in my experience they only partner with compliance partners, and will only attest to their products (and not even all of them).
- selinkocalar 3y ago
  Glad you pointed these out! Regarding your first point, we've partnered with auditors at Insight Assurance. We've worked with them to map our compliance workflow, infra setup, and controls list with their auditing controls list. This lets us ensure that our compliance tool meets the standards necessary for a HIPAA audit as well as general security best practices. Regarding your second point, we've put our infrastructure configuration through multiple rounds of review with AWS architects that we are working with through YC, with an exited DevOps engineer/founder that we've hired onto our own team, and with our own technical background from MIT. Of course, we have no official attestation from AWS. We've done a lot of due diligence in battle-hardening our infra setup (one of our clients receives 3M+ postgres requests an hour, which we are able to support).
keepamovin 3y ago
Excellent! Do you have any plans to support NIST SP 800 171 in future too? https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final
- selinkocalar 3y ago
  Thanks! No plans for NIST at the moment but potentially down the line.
rickysahu 3y ago
theres a number of dead bodies in this space. it sounds like a great idea but once companies get big theyll diy. so your only market will be early startups for 1-3 years max and then theyll churn bf they ever get big enough to pay you what it's worth to get them on your platform in rhe first place. look at aptible and datica.
- selinkocalar 3y ago
  Thanks for sharing that insight. It's a stepping stone and it's critical to move quick.
1nighthawk 3y ago
Great take! However, I wonder how you differentiate from platforms like Vanta? They already provide the monitoring and compliance framework you'll need anyway at some point. Frankly (and I don't want to sound too negative here) I doubt that a "one click compliant infrastructure" can work without knowing anything about the use case / application / dependencies of a company. Remember, it's not just about your system, its also about the stack you're building with, so it's quite a complex problem to solve.
- selinkocalar 3y ago
  Thanks for that! And good question. Vanta offers a compliance checklist and integrates with your service providers (such as AWS, Github, etc.) to continuously monitor your system settings and flag potential vulnerabilities. We provide a similar compliance checklist to Vanta, as well as HIPAA-compliant infrastructure and technical configurations. We’ll set up your application on compliant infrastructure deployed in your cloud, integrate CI/CD pipelines, and provide real-time logging/monitoring. Providing the technical piece that's compliant out of the box lets you save weeks of manual work configuring it yourself and having Vanta's API integration/AWS audit manager check it. We use terraform to automate the infrastructure deployment process in a modular fashion. When you deploy with us, we take a dockerfile and basic information about your infrastructure setup, such as your availability region, RDS configs, instance sizes, etc. to deploy your application. This lets us support a variety of use cases and needs.
keu24 3y ago
This looks really Great!!! Quick Question: How are the features and services different from what is offered by Drata and Secureframe?
- selinkocalar 3y ago
  Thank you - we really appreciate it! Drata and Secureframe provide a compliance checklist and integrate with some of your vendors (i.e. AWS, Github, etc.) to passively monitor your configurations and flag concerns. We provide the same compliance checklist that Drata and Secureframe does, and also give you HIPAA compliant technical configurations. We'll deploy your application with infrastructure that's compliant out of the box, provide CI/CD pipelines, and a real-time monitoring/logging solution. We do a lot of work on our end to block attacks, proxy you through our firewalls, and automate your DevOps/delay your need to hire a DevOps team. These are all things you'd have to manually configure on Drata and Secureframe. By automating this, we save you weeks of work.

111 points by selinkocalar 3y ago

igcbsgd 3y ago

[dead]

rposborne 3y ago

How do you beat https://www.aptible.com/ https://www.aptible.com/?

deleted 3y ago
[deleted]
selinkocalar 3y ago
Great question! Aptible is great for deploying HIPAA-compliant applications, but you still have to purchase another solution for completing the legal policies and compliance checklist, such as Vanta. Think of us like Aptible + Vanta. Because you deploy your application through us, we can give you deep insights into your security and compliance. For example, we give you legal policies that have already been customized to your infrastructure setup. Similarly, we provide a logging/monitoring dashboard that is designed to meet what auditors look for in your infrastructure setup. Putting all your compliance solutions in one place lets us streamline the path to compliance.
- fancyremarker 3y ago
  Hi! Aptible founder here. I wanted to make an important correction here. Aptible has a built-in Security & Compliance Dashboard [0] that supports compliance automation and reporting (PDF and API exports) for HIPAA, HITRUST and other security frameworks. You can see a demo of the entire platform, including this Dashboard, in our "Aptible in 10 Minutes" video. [1] You can also integrate Aptible with Vanta, Drata or another compliance automation tool, if you're running the self-hosted version of Aptible that runs in your own AWS account. If you do, you can expect fully passing tests for HIPAA and SOC 2 in Vanta or Drata with zero additional configuration. Most Aptible customers find our built-in dashboard sufficient, and don't feel the need to buy Vanta/Drata separately to ensure HIPAA compliance. [0] https://www.aptible.com/docs/intro-compliance-dashboard https://www.aptible.com/docs/intro-compliance-dashboard [1] https://www.youtube.com/watch?v=mhNzGO9KbWY https://www.youtube.com/watch?v=mhNzGO9KbWY
  - selinkocalar 3y ago

iends 3y ago

I didn't see the mention of BAAs anywhere. Do you handle getting that signed with vendors like AWS?

selinkocalar 3y ago
Yes! We outline BAA requirements in our compliance checklist (i.e. we'll provide the exact steps of how to get a BAA with AWS and remind you to get BAAs with other 3rd parties). We're also building out a small network of 3rd party vendors that we work closely with to help our customers get BAAs signed quick and offer discounts to those 3rd parties' services.
- candiddevmike 3y ago
  Do you enter into a BAA with all of your customers?
  - selinkocalar 3y ago
    Yes, we sign sub-BAAs with our customers.

debarshri 3y ago

Every org that starts out with an compliance oriented SaaS in my experience ends up migrating out of it eventually because when they grow - they have more capital to build their own infrastructure as hire more engineers who do not want to deal with kinks of a SaaS abstraction. If you are using Vanta or Drata at early staging and opt for HIPAA framework, you do get the list of controls that you have to implement that also include cloud specific configuration changes that you need to do. And these changes are one time thing, continuously monitored by the framework. My argument is that, the target market you trying sell - early stage HIPAA compliance market is not difficult anymore. I hope this feedback helps you to foresee possible problems.

selinkocalar 3y ago
Thanks for the transparency and thoughts on this! We provide a lot of active elements, such as our infrastructure logging/monitoring dashboard, email alerts, and code vulnerability scans every time you git push, so that we aren't just a one-time purchase. We help you be proactive about preventing breaches instead of just integrating with your AWS API and passively monitoring. One of the biggest things about HIPAA is that it isn't just your initial setup that matters, it's how you manage compliance on an ongoing basis that's important for maintaining security and privacy. We're also growing with our customers and moving upstream, and keeping in mind exactly what you said about preventing SaaS churn. As we do this, we're following the core thesis that compliance should bridge legal, DevOps, and cybersecurity, and when you combine all these you can get much deeper insights into security and can integrate deeper within an organization to provide more proactive measures.
- debarshri 3y ago
  Solutions like this wont work in large orgs that have lead to huge ACVs. Would be more happy if you prove me wrong.
  - throwkjkbkljbk 3y ago
    No you're right for sure. Aptible is mentioned a few commends down, and is/was basically the same business (compliance focused hosting for small startups). Now Aptible has seemingly pivoted away from that focus and are now trying to compete in the PaaS space. There are a couple of obvious reasons here. 1. You're limiting your TAM to just healthcare startups. Why? 2. After not that long, it doesn't make financial sense for your customers to stick with you. I speak from experience on this one having moved some number of customers off of Aptible in the past. Aptible was charging 10X AWS for a pretty thin wrapper around AWS. At any kind of scale beyond a handful of machines it makes sense to just bite the bullet and hire a devsecops person, who in the end will do more for you. My advice here is to think bigger. Think about what value the GRC/Security/DevOps teams of bigger orgs are delivering and how you could displace (some) of them.

ramzez 3y ago

is there pricing information?

selinkocalar 3y ago
We charge a fixed annual fee — zero usage-based costs. We deploy all on your own AWS cloud so you're not paying any marked up fees or being faced with surprise bills. If you have any thoughts on this would love to hear them!
- Sephr 3y ago
  Can you provide any numerical information regarding the pricing of your service? e.g. Variable pricing thresholds, target ICP budget, and service tiers are all relevant information here.
btoro 3y ago
I'd also like to see pricing info available.

a_gnostic 3y ago

It does more than just protecting sensitive health information, it also governs how billing works, so if you've ever wondered why some Dr. you never met is sending you bills in the thousands of dollars; HIPAA is where you can find out why!

selinkocalar 3y ago
Yes! HIPAA was initially rolled out for the portability and continuity of health insurance coverage. But over the years, with the enactment of the Privacy Rule, Security Rule, HITECH Act, Omnibus Rule, etc., HIPAA's implications have been shaped quite a bit.
a_gnostic 3y ago
Spoiler: Anyone who touches the patient, anyone who has a conversation with the patient, anyone who measures stuff of the patient, doctors consulted by doctors also get to charge. So that's why suddenly every nurse wants to talk to you, check your blood pressure, and a different nurse wants your blood oxygenation… and that guy that walked by who greeted the doctor seeing you, and talked about how much the 49ers sucked last weekend, and flirted with the nurse? Bill's in the mail.
- SkyPuncher 3y ago
  No, that is not at all why. There are avenues for billing via consult (eg doc to doc conversations), but what you claim is very far from the truth.

johnxie 3y ago

Very cool! Is there an equivalent for SOC2, GDPR, etc...?

selinkocalar 3y ago
We're rolling out SOC2 in a month! GDPR, HITRUST, etc. are down the line.

candiddevmike 3y ago

How does this compare to OneTrust and Tugboat?

selinkocalar 3y ago
Of course! Tugboat by OneTrust provides compliance checklist and preparation tools (i.e. InfoSec policies, audit management, controls mappings). We provide a similar compliance checklist/preparation tool to Tugboat, as well as HIPAA-compliant infrastructure and technical configurations. We’ll set up your application on compliant infrastructure deployed in your cloud, integrate CI/CD pipelines, and provide real-time logging/monitoring. Providing the technical piece that's compliant out of the box lets you save weeks of manual work configuring it yourself. By covering you not only on an administrative/compliance front, but also on a technical/cybersecurity front, we help you actively enforce good security and monitor compliance comprehensively.

fishpen0 3y ago

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are all AWS-centric

technics256 3y ago
Interesting, haven't heard of this. Always figured aws and gcp were ahead of azure in terms of Healthcare
- fishpen0 3y ago
  They are, so I want to smash my face in once a month or so when this boogeyman is dragged up out of hell during executive calls
- robertlagrant 3y ago
  They're ahead technically, but, for example, Microsoft has its claws in a lot of the NHS in the UK.
- kstrauser 3y ago
  AWS is fine for building out HIPAA services. They have a decent portal at https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/ explaining their compliance, which services you can use, and how to get them to sign a Business Associate Agreement (BAA). I haven't done healthcare stuff in GCP or Azure so I can't compare, but AWS is _not_ a blocker for HIPAA.
  - FireBeyond 3y ago
    > I haven't done healthcare stuff in GCP My understanding is that Google will not agree to any of the liability provisions inherent to a BAA, no matter how large your size.

burnte 3y ago

Healthcare CIO/VP here. Some thoughts to help you improve your communication to potential customers, AKA what I look for when I am evaluating a platform for healthcare use: The website is too thin, it looks like you're really heavily relying on meetings to get customers rather than the product itself. I think you should dedicate some resources to fleshing out the website A LOT with more information because it actually looks like a potentially useful product, but I'm not going to commit to a presentation just for more info. This is a red flag, as in my experience companies with little public info and who want to share everything in demos/meetings have a lot of warts they try to hide by a highly curated meeting experience. Cancel the blog portion, it's 2024 and no one cares about company blogs. No one ever DID, but they were popular for a hot minute anyway, and that minute is gone. Don't blog and take that time to flesh out the website dramatically. Right now your sole blog post is a 2 minute intro to HIPAA. Anyone who doesn't know what HIPAA is will not be a customer, so this post isn't helping you at all. I think your #1 priority this week should be flooding the website with information about the product. How-To guides, detailed descriptions of features, videos, even an interactive demo would be great. I'm not sure if your product is narrow and focused on helping code compliant apps, or if you're a general compliance checklist suite. The latter is WAY more useful than the former. If you're the former, I'd suggest expanding your scope to get more business. when I thought this was an enhanced HIPAA compliance suite, I was ready to get more info, now that I see it may be focused on app development only, I don't care about it, as honestly getting computers compliant is a lot easier than getting humans and processes compliant. If you're not just focused on development, this reinforces the website problem. Kill your FAQ: "How is Delve different?" Please flesh this out to about 1,000-1,500 words on another page and go into more detail. "Has Delve been reviewed by HIPAA auditors?" Don't tell me, link me to your PDF compliance reports. "How do I know your infrastructure is secure?" Combine this with the question above and link me to your PDF compliance reports. Then make it it's own page like with the question above. "How can I show my customers that I’m HIPAA compliant?" Again, it's 2024, no one cares about badges, they want BAAs and compliance reports. People understand today that a little badge on a webpage means nothing. This isn't even a question you should be answering, actually. Only your customers can answer that through knowledge of their customer base. You look like a promising startup, I hope you accept this critique from a decision maker in your target audience in the spirit it's offered. It's not meant to say you're bad or dumb, you just need to spend some real time on the website and information shared with potential clients. Right now you look interesting, but not enough for me to reach out yet. A more detailed website would change that a lot.

afro88 3y ago

Looks great, and I wish this existed 2 years ago when I started building a HIPAA compliant product! But I immediately had a few questions and am hesitant to book a demo (I'm quite time poor): 1. What clouds do you support? 2. What does the infrastructure look like, what services does it use? 3. Do I get locked into a particular orchestration or deployment setup? We prefer k8s for example.

selinkocalar 3y ago
Thanks for the question! 1) We’ve made the conscious decision to start with AWS support, as our ICP is primarily on AWS (80%+). We plan to roll out GCP and Azure once we have sufficient coverage on AWS services. (2) When you’re onboarded, we deploy a series of base resources (IBNLT networking resources, notification services, logging services). You can then select from a library of supported resources for your application-specific environment. (3) To directly answer your question — no you are not locked in and can change as you see fit. Also, because we deploy infrastructure in your own cloud, you're able to go in anytime and make custom modifications to your infrastructure.
- afro88 3y ago
  Many thanks for the answers. In reply to 3, can you clarify the details of what deployment snd orchestration tools you set up for your customers? And if we are able to make modifications to the underlying infra, is there some kind of process that prevents changes that break HIPAA compliance?
  - selinkocalar 3y ago
    Sure thing! Under the hood, we define infrastructure using Terraform to explicitly define logical relationships between resources, easily enforce deny by default behavior, and spin up resources with granular access logging by default. We then expose a subset of toggles that users can adjust (compute resources, service connections, silo’d application deployment). Some toggles that may have a business need, but would prove to carry excess risk (such as blanket public exposure of data store’s), are explicitly disallowed. This is a decision that we’ve made and feel offers the ideal balance between flexibility and compliance enforcement.

pierat 3y ago

Well that'll be a fun name change. Are you Delve , or Microsoft Delve? https://support.microsoft.com/en-us/office/what-is-delve-1315665a-c6af-4409-a28d-49f8916878ca https://support.microsoft.com/en-us/office/what-is-delve-131... Aside that, neat idea.

selinkocalar 3y ago
Ah, we're the other Delve - the one that doesn't come with an Office subscription but makes your office HIPAA compliant.

imglorp 3y ago

Sort of related: it seems like compliant providers and services are carrying the burden of patient privacy in good faith, securing the front door. Meanwhile, there are open tent flaps on the sides and back. It's hard to do the right thing while there are minimal regs and enforcement on the rest of the ecosystem. Eg, Tracking on medical sites let Meta go to town -- https://www.theverge.com/2022/8/2/23288612/meta-hosptials-sued-patient-privacy-facebook-data-hipaa https://www.theverge.com/2022/8/2/23288612/meta-hosptials-su... Eg, Patient data brokers: "Currently, under HIPAA there is no law prohibiting the use of healthcare data shared via marketing practices." -- https://www.beckershospitalreview.com/healthcare-information-technology/healthcare-data-for-sale-how-data-brokers-are-packing-selling-patient-data.html https://www.beckershospitalreview.com/healthcare-information...

selinkocalar 3y ago
Yes, you’re correct in your assertion that infrastructure policies are just one part of the puzzle. In conjunction with our preconfigured deployments, we provide customers a set of legal policies we’ve worked with former US Attorneys to closely align with the spirit of HIPAA enforcement. We’ve all seen the countless byteDance and Meta cookie data leakage headlines on insurance and healthcare portals, and provide customers with notice to remove trackers, or sign BAAs with user metrics companies where possible.
- Sephr 3y ago
  > [we] provide customers with notice to remove trackers, or sign BAAs with user metrics companies where possible Do you provide any technical solutions to help your customers control these trackers in accordance with HIPAA and privacy laws, or do you refer your customers to third-party privacy solutions to accomplish this? You expressed disdain for "hitting checkboxes," yet your solutions to this specific problem appear to be more checkboxes. Asking customers to remove a tool from their site or request tool vendors to sign a contract is helpful, but it forces customers to make tough decisions: Do I lose revenue by completely removing a tool? Can I trust a vendor to follow their BAA? Technical compliance solutions can remove this source of uncertainty by directly controlling tracker behavior on a fine-grained level.

dekhn 3y ago

I remember early in Google Cloud I was working with a Google PM on health-related projects (Google Cloud Genomics). The PM was our ostensible expert on HIPAA, and explained many details (such as BAA). The one funny thing they said is "there is no such thing as HIPAA compliance, that term is meaningless". And I don't really understand what they meant, but I think they must have been wrong (even though they were supposed to be the subject matter expert).

debarshri 3y ago
You PM is right. Unlike SOC2, you dont get a certification. More details here [1] [1] https://compliancy-group.com/what-is-a-hipaa-certification/ https://compliancy-group.com/what-is-a-hipaa-certification/
- dekhn 3y ago
  Maybe. But Google Cloud has adopted the compliance terminology: https://cloud.google.com/security/compliance/hipaa https://cloud.google.com/security/compliance/hipaa
- kstrauser 3y ago
  However, if you want to do business with any reasonable size of healthcare org, you're eventually gonna have to get a HITRUST report.
  - selinkocalar 3y ago
    That's true. Curious what your experience has been with HITRUST
    - kstrauser 3y ago
      Layoffs caught me before we finished the audit so I can’t say with full confidence. However, if you have a SOC 2 type 2 report, you’re probably 90% of the way there. They’re not perfect overlaps but it’s more like a circle viewed with astigmatism than the Mastercard logo.

Aaronstotle 3y ago

Does this relate to HITRUST as well? I know the pain of those audits as I worked for healthcare companies that had them and a lot of the rules are similar.

selinkocalar 3y ago
It's slightly similar but HITRUST is still more comprehensive and is built on the CSF framework. HITRUST was initially developed as the answer to HIPAA compliance, although the framework has now been rebranded as industry-agnostic. Hence, there is a good amount of overlap as you mentioned.

stevenicr 3y ago

So this is for AWS style hosting, and there is no pricing info. I am interested in this and will be someone could be pitching this to many others, but I want it with cpanel cloud hosting not aws/git/whatever.

selinkocalar 3y ago
You’re correct, we are putting our engineering focus into designing an enjoyable experience with AWS as our launch pad, and broadening our supported cloud providers as we continue to build out. I’ve only seen and personally used CPanel for on-prem management (paired with WHMCS for billing), which is not something I’ve come across so far here. Happy to talk about this more though if you have time.

user3939382 3y ago

My 5 second reaction having managed a large organization in a compliance/regulatory driven environment is that these regulations need to be part of the orgs DNA or long term you’ll be buried by an audit. It’s not something you bolt on.

selinkocalar 3y ago
Yes, exactly. This is a similar battle IT folks face with implementing best practices with it comes to cyber hygiene, and the sooner it’s solidified, the better (shift left approach). That's been our current approach with helping early stage health tech startups, and will be a tough but rewarding battle as we move towards organizations with established practices (be it good or bad). Curious to talk more with you about this if you have time.
- user3939382 3y ago
  Sure. My email is in profile.

hbcondo714 3y ago

> Most companies that process health information in the US need to become HIPAA compliant I appreciated what Delve is doing for these kind of companies but what about non-tech small companies & individual therapists that process health data? We enlist the services of multiple behavioral / mental health providers and most of them use personal devices / SMS / GMail for transmitting PHI[1]. I understand this may not be the target audience for Delve but getting these kind of companies HIPAA-compliant is a real need. [1] https://www.hhs.gov/answers/hipaa/what-is-phi/index.html https://www.hhs.gov/answers/hipaa/what-is-phi/index.html

selinkocalar 3y ago
It's an interesting point you raise. You're correct in that our current target audience primarily covers the companies that provide services to healthcare providers instead of actual healthcare providers. For more context, HIPAA breaks companies into two categories: (1) Covered Entities, which are healthcare providers, health plans, and healthcare clearinghouses, and (2) Business Associates, which are companies that process PHI on behalf of Covered Entities. Behavioral/mental health providers fall into the Covered Entity category, and their requirements under HIPAA are different than those of Business Associates. Our services are currently focused on supporting Business Associate needs.
- fhsm 3y ago
  > … providers fall into the Covered Entity category … If doctor etc is a Covered Entity then that doctor is most likely a Provider, but is every doctor providing healthcare a really CE? I wouldn’t have said no but I don’t track it ultra closely so I’m curious what’s the latest? My first three results matched my expectation but they could easily be out of date… https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-covered-entity-if-you-dont-bill-electronically/ https://www.epatientdave.com/2020/02/03/hipaa-you-arent-a-co... https://www.stevenslee.com/health-law-observer-blog/is-a-cash-only-medical-practice-subject-to-hipaa/ https://www.stevenslee.com/health-law-observer-blog/is-a-cas... https://www.americares.org/wp-content/uploads/globalassets/_snc/eduresources/practicefacility/hipaa/2.-hipaa-faqs-may-2014.pdf https://www.americares.org/wp-content/uploads/globalassets/_... Anyway re the parent, my fourth result uses therapist as the example of uncovered providers, which would have been my guess https://www.consumerreports.org/health/health-privacy/guess-what-hipaa-isnt-a-medical-privacy-law-a2469399940/ https://www.consumerreports.org/health/health-privacy/guess-...

deleted 3y ago

[deleted]

eddywebs 3y ago

Congratulations on Launch! Would you be plan to expand to Salesforce platform ? I am Salesforce partner would love to connect if you looking for implementation partners.

selinkocalar 3y ago
Happy to chat further and learn more about what you were thinking, our Calendly is always open: https://calendly.com/getdelve/demo https://calendly.com/getdelve/demo

javiramos 3y ago

I wish a solution like this for ITAR compliance

selinkocalar 3y ago
If we're being honest ITAR is quite far from HIPAA - can't promise that we'll get to it anytime soon :)

zackify 3y ago

What if I want to use the service but keep my already hipaa compliant hosting platform?

selinkocalar 3y ago
Nice question. If you're using another platform to manage the infrastructure/hosting, you'd be able to integrate with us to complete the remaining parts necessary to get HIPAA compliant (i.e. the legal policies, compliance task list, risk assessments, vendor reviews, etc.). That being said, a lot of our customers prefer migrating over to our infrastructure because many hosting services charge high usage-based fees for HIPAA compliance and it ends up being cheaper to deploy straight onto AWS, where they can use their AWS credits, for their infrastructure management.

chevman 3y ago

So what you may have already discovered, is HIPAA compliance, HiTrust certification, BAAs, etc are table stakes for servicing covered entities in the healthcare space. They are all preludes, however, to agreeing to liability amounts/indemnification in the actual contract. This is why, as an example, most healthcare orgs end up moving away from Google. Google (to my knowledge, which includes large deals at F50 level), will not contractually agree to any kind of financial or legal liability for data breaches, hacks etc. Microsoft (and to a lesser extent Amazon) will agree to such terms if you're a big enough account, and generally already have some kind of framework in place with your procurement dept likely that simply needs to be amended. This is also why larger healthcare orgs are reticent to work with smaller, less well capitalized startups in the ecosystem. The liability alone should something go wrong would potentially vaporize your company, and would definitely lead to uncomfortable conversations with your investors (who maybe, might also have large holdings in the larger healthcare orgs and be incented to not do stupid things that would create massive liabilities!).

cbg0 3y ago
> This is also why larger healthcare orgs are reticent to work with smaller, less well capitalized startups in the ecosystem. The liability alone should something go wrong would potentially vaporize your company While this sounds very dramatic, aren't the "less well capitalized startups" in your scenario the ones responsible for their own HIPAA violations, and not the larger healthcare orgs?
- fluidcruft 3y ago
  There's also the business risk that a company you depend on goes poof and you're left scrambling (scrambling doesn't work well in healthcare IT, so much of it is bespoke and barely working... projects that look like they should work routinely fail years later in at integration setting everything back three years... it's a mess).
selinkocalar 3y ago
Completely agreed. Trust and credibility are harder to prove for startups trying to contract to large health organizations, which is why a HIPAA compliance report or active monitoring from a 3rd party can be really helpful. Some large hospitals even turn away calls from startups for this exact reason. Compliance is table stakes. It's important to address HIPAA early and be able to attest to your compliance and security.

FireBeyond 3y ago

As someone who has been in healthcare IT for maybe 10 years, comfortable with HIPAA HITECH, SAS70, etc., one thing I took a pause at was: > Yes! HIPAA auditors have reviewed Delve to ensure that we cover HIPAA requirements. To me, the word 'review' is doing a bit of heavy lifting. There's a lot of self-attestation in the HIPAA world, a lot of policies and processes - but to my understanding (and forgive me if it is flawed), any actual auditing is on specific implementation, not generalized. I think your statement is accurate, to be clear - but I think the concern I had was that someone less nuanced or experienced might read something that isn't there into it - i.e. "our tooling has been audited". (Mind you, I also think that someone "less nuanced or experienced" probably shouldn't be heading up a PHI solution, so maybe self-selecting). Also: > Our infrastructure has been vetted by cybersecurity and DevOps experts from AWS, Google Cloud, and more. Similarly, this heavily implies that AWS has done some attestation on your product, which I doubt. For one, in my experience they only partner with compliance partners, and will only attest to their products (and not even all of them).

selinkocalar 3y ago
Glad you pointed these out! Regarding your first point, we've partnered with auditors at Insight Assurance. We've worked with them to map our compliance workflow, infra setup, and controls list with their auditing controls list. This lets us ensure that our compliance tool meets the standards necessary for a HIPAA audit as well as general security best practices. Regarding your second point, we've put our infrastructure configuration through multiple rounds of review with AWS architects that we are working with through YC, with an exited DevOps engineer/founder that we've hired onto our own team, and with our own technical background from MIT. Of course, we have no official attestation from AWS. We've done a lot of due diligence in battle-hardening our infra setup (one of our clients receives 3M+ postgres requests an hour, which we are able to support).

keepamovin 3y ago

Excellent! Do you have any plans to support NIST SP 800 171 in future too? https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final

selinkocalar 3y ago
Thanks! No plans for NIST at the moment but potentially down the line.

rickysahu 3y ago

theres a number of dead bodies in this space. it sounds like a great idea but once companies get big theyll diy. so your only market will be early startups for 1-3 years max and then theyll churn bf they ever get big enough to pay you what it's worth to get them on your platform in rhe first place. look at aptible and datica.

selinkocalar 3y ago
Thanks for sharing that insight. It's a stepping stone and it's critical to move quick.

1nighthawk 3y ago

Great take! However, I wonder how you differentiate from platforms like Vanta? They already provide the monitoring and compliance framework you'll need anyway at some point. Frankly (and I don't want to sound too negative here) I doubt that a "one click compliant infrastructure" can work without knowing anything about the use case / application / dependencies of a company. Remember, it's not just about your system, its also about the stack you're building with, so it's quite a complex problem to solve.

selinkocalar 3y ago
Thanks for that! And good question. Vanta offers a compliance checklist and integrates with your service providers (such as AWS, Github, etc.) to continuously monitor your system settings and flag potential vulnerabilities. We provide a similar compliance checklist to Vanta, as well as HIPAA-compliant infrastructure and technical configurations. We’ll set up your application on compliant infrastructure deployed in your cloud, integrate CI/CD pipelines, and provide real-time logging/monitoring. Providing the technical piece that's compliant out of the box lets you save weeks of manual work configuring it yourself and having Vanta's API integration/AWS audit manager check it. We use terraform to automate the infrastructure deployment process in a modular fashion. When you deploy with us, we take a dockerfile and basic information about your infrastructure setup, such as your availability region, RDS configs, instance sizes, etc. to deploy your application. This lets us support a variety of use cases and needs.

keu24 3y ago

This looks really Great!!! Quick Question: How are the features and services different from what is offered by Drata and Secureframe?

selinkocalar 3y ago
Thank you - we really appreciate it! Drata and Secureframe provide a compliance checklist and integrate with some of your vendors (i.e. AWS, Github, etc.) to passively monitor your configurations and flag concerns. We provide the same compliance checklist that Drata and Secureframe does, and also give you HIPAA compliant technical configurations. We'll deploy your application with infrastructure that's compliant out of the box, provide CI/CD pipelines, and a real-time monitoring/logging solution. We do a lot of work on our end to block attacks, proxy you through our firewalls, and automate your DevOps/delay your need to hire a DevOps team. These are all things you'd have to manually configure on Drata and Secureframe. By automating this, we save you weeks of work.