4 ms·

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon,

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are all AWS-centric

technics256 3y ago
Interesting, haven't heard of this. Always figured aws and gcp were ahead of azure in terms of Healthcare
- fishpen0 3y ago
  They are, so I want to smash my face in once a month or so when this boogeyman is dragged up out of hell during executive calls
- robertlagrant 3y ago
  They're ahead technically, but, for example, Microsoft has its claws in a lot of the NHS in the UK.
- kstrauser 3y ago
  AWS is fine for building out HIPAA services. They have a decent portal at https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/ explaining their compliance, which services you can use, and how to get them to sign a Business Associate Agreement (BAA). I haven't done healthcare stuff in GCP or Azure so I can't compare, but AWS is _not_ a blocker for HIPAA.
  - FireBeyond 3y ago
    > I haven't done healthcare stuff in GCP My understanding is that Google will not agree to any of the liability provisions inherent to a BAA, no matter how large your size.
    - kstrauser 3y ago
      Someone else linked to https://cloud.google.com/security/compliance/hipaa https://cloud.google.com/security/compliance/hipaa which says: > Google will enter into Business Associate Agreements with customers as necessary under HIPAA. Huh! That's a pleasant surprise.
      - selinkocalar 3y ago
        I've heard that that page is outdated and instead if you sign into G Suite as an admin, go to the admin console (admin.google.com/ac/companyprofile/legal) and then go to "Security and Privacy Additional Terms" you can review sign a BAA.
selinkocalar 3y ago
We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. So far, we haven't gotten any major requests for expanding to other cloud providers and most of our incoming customers are already on AWS anyways. One of the main reasons why healthcare players were moving onto Azure was for in-built HIPAA compliant OpenAI access. We've been able to help our customers directly sign BAAs with OpenAI so this wasn't a concern.
- DaiPlusPlus 3y ago
  > for in-built HIPAA compliant OpenAI access Sorry but what?
  - selinkocalar 3y ago
    A lot of healthcare companies are wanting to use GPT4, Whisper, and other LLMs from OpenAI, but these aren't HIPAA compliant out of the box. You still have to sign a BAA with OpenAI and get on their zero data retention (ZDR) plan. Because of the close partnership with Microsoft and OpenAI, Azure makes it easy to get HIPAA compliant access to certain OpenAI models without having to go through OpenAI directly. This is why a lot of AI healthcare companies were building on Azure at first. Hope this clarifies!
- leetrout 3y ago
  > We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. Nothing could be further from the truth.
  - doctorpangloss 3y ago
    You’re right but the kind of people who buy this service buy into the perception that Terraform is cloud agnostic, and perception is reality. Another POV is that the compliance companies sell the holistic social experience of compliance. The people for whom this matters need checkboxes and don’t mind paying for consulting disguised as a CSA. In fact they may even prefer it.
agilob 3y ago
I'm in banking and we have similar pressure to leave AWS, but for different reasons. Simply too many banking services are already on AWS, and if a single could goes down it mustn't take most of banking infrastructure of a country.
- Clubber 3y ago
  I figured most of the big banks still use AS400s. Have they finally shed those?
  - dboreham 3y ago
    Surely mainframes?
- d0gsg0w00f 3y ago
  I work at a mega bank and I haven't heard this angle yet. We are pushing lots to cloud. We have "yes, we're serious" resiliency and regulatory requirements though. Regulatory is where a country in which we do business has requirements for how we run our infrastructure. Luxembourg is notorious for being the most demanding.
  - agilob 3y ago
    https://dantheengineer.com/bank-of-england-worried-about-concentration-of-risk-in-the-cloud/ https://dantheengineer.com/bank-of-england-worried-about-con...

technics256 3y ago

Interesting, haven't heard of this. Always figured aws and gcp were ahead of azure in terms of Healthcare

fishpen0 3y ago
They are, so I want to smash my face in once a month or so when this boogeyman is dragged up out of hell during executive calls
robertlagrant 3y ago
They're ahead technically, but, for example, Microsoft has its claws in a lot of the NHS in the UK.
kstrauser 3y ago
AWS is fine for building out HIPAA services. They have a decent portal at https://aws.amazon.com/compliance/hipaa-compliance/ https://aws.amazon.com/compliance/hipaa-compliance/ explaining their compliance, which services you can use, and how to get them to sign a Business Associate Agreement (BAA). I haven't done healthcare stuff in GCP or Azure so I can't compare, but AWS is _not_ a blocker for HIPAA.
- FireBeyond 3y ago
  > I haven't done healthcare stuff in GCP My understanding is that Google will not agree to any of the liability provisions inherent to a BAA, no matter how large your size.
  - kstrauser 3y ago
    Someone else linked to https://cloud.google.com/security/compliance/hipaa https://cloud.google.com/security/compliance/hipaa which says: > Google will enter into Business Associate Agreements with customers as necessary under HIPAA. Huh! That's a pleasant surprise.
    - selinkocalar 3y ago
      I've heard that that page is outdated and instead if you sign into G Suite as an admin, go to the admin console (admin.google.com/ac/companyprofile/legal) and then go to "Security and Privacy Additional Terms" you can review sign a BAA.

selinkocalar 3y ago

We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. So far, we haven't gotten any major requests for expanding to other cloud providers and most of our incoming customers are already on AWS anyways. One of the main reasons why healthcare players were moving onto Azure was for in-built HIPAA compliant OpenAI access. We've been able to help our customers directly sign BAAs with OpenAI so this wasn't a concern.

DaiPlusPlus 3y ago
> for in-built HIPAA compliant OpenAI access Sorry but what?
- selinkocalar 3y ago
  A lot of healthcare companies are wanting to use GPT4, Whisper, and other LLMs from OpenAI, but these aren't HIPAA compliant out of the box. You still have to sign a BAA with OpenAI and get on their zero data retention (ZDR) plan. Because of the close partnership with Microsoft and OpenAI, Azure makes it easy to get HIPAA compliant access to certain OpenAI models without having to go through OpenAI directly. This is why a lot of AI healthcare companies were building on Azure at first. Hope this clarifies!
leetrout 3y ago
> We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. Nothing could be further from the truth.
- doctorpangloss 3y ago
  You’re right but the kind of people who buy this service buy into the perception that Terraform is cloud agnostic, and perception is reality. Another POV is that the compliance companies sell the holistic social experience of compliance. The people for whom this matters need checkboxes and don’t mind paying for consulting disguised as a CSA. In fact they may even prefer it.

agilob 3y ago

I'm in banking and we have similar pressure to leave AWS, but for different reasons. Simply too many banking services are already on AWS, and if a single could goes down it mustn't take most of banking infrastructure of a country.

Clubber 3y ago
I figured most of the big banks still use AS400s. Have they finally shed those?
- dboreham 3y ago
  Surely mainframes?
d0gsg0w00f 3y ago
I work at a mega bank and I haven't heard this angle yet. We are pushing lots to cloud. We have "yes, we're serious" resiliency and regulatory requirements though. Regulatory is where a country in which we do business has requirements for how we run our infrastructure. Luxembourg is notorious for being the most demanding.
- agilob 3y ago
  https://dantheengineer.com/bank-of-england-worried-about-concentration-of-risk-in-the-cloud/ https://dantheengineer.com/bank-of-england-worried-about-con...