3 ms·
I remember early in Google Cloud I was working with a Google PM on health-related projects (Google Cloud Genomics). The PM was our ostensible expert on HIPAA,
by dekhn 3y ago
I remember early in Google Cloud I was working with a Google PM on health-related projects (Google Cloud Genomics). The PM was our ostensible expert on HIPAA, and explained many details (such as BAA). The one funny thing they said is "there is no such thing as HIPAA compliance, that term is meaningless". And I don't really understand what they meant, but I think they must have been wrong (even though they were supposed to be the subject matter expert).
- debarshri 3y agoYou PM is right. Unlike SOC2, you dont get a certification. More details here [1] [1] https://compliancy-group.com/what-is-a-hipaa-certification/ https://compliancy-group.com/what-is-a-hipaa-certification/
- dekhn 3y agoMaybe. But Google Cloud has adopted the compliance terminology: https://cloud.google.com/security/compliance/hipaa https://cloud.google.com/security/compliance/hipaa
- kstrauser 3y agoHowever, if you want to do business with any reasonable size of healthcare org, you're eventually gonna have to get a HITRUST report.
- selinkocalar 3y agoThat's true. Curious what your experience has been with HITRUST
- kstrauser 3y agoLayoffs caught me before we finished the audit so I can’t say with full confidence. However, if you have a SOC 2 type 2 report, you’re probably 90% of the way there. They’re not perfect overlaps but it’s more like a circle viewed with astigmatism than the Mastercard logo.
- selinkocalar 3y agoYour PM was probably referencing the fact there is no audit requirement — HIPAA is self attestation. HIPAA compliance can be boiled down to “implement best security practices, record every request & transaction, and enforce zero trust to the truest exist possible.” Once you've done your due diligence with this, you can self attest compliance.
- Spooky23 3y agoIt's a weird topic. I always laugh about how "difficult" HIPAA compliance is often portrayed as in online forums. It's a reminder to me of how important due diligence is. Of the various regulatory regimes, HIPAA is not particularly challenging, and if it is, I'd be concerned with doing business with the entity in other contexts.
- dekhn 3y agoWhat I laugh about is that more than once I have had to explain HIPAA to my corp lawyer. I've had actual discussions where the lawyers proposed an immense amount of work, followed by me explaining that our work doesn't fall into the scope of HIPAA and therefore we do not need to comply with it or get any certification or sign a BAA at all. "But... .but .... we should comply anyway just to be on the safe side!".
- Spooky23 3y agoFew things are more annoying than a lazy attorney prioritizing personal CYA vs representing the client or employer. My favorite example is a clown who decided when I was on vacation that we should “voluntarily comply” with IRS 1075 guidelines, in a context that had absolutely nothing to do with the IRS. The motivation was to literally reuse work done for another, unrelated client and protect.
- selinkocalar 3y agoWe totally understand! We value complete transparency at Delve. If a startup doesn't need compliance (i.e. they fall under the Safe Harbor Provision or are a consuming-facing without connection to a Covered Entity), we'll tell them upfront. We value building honest relationships with founders.