3 ms·

> I was ready to get more info, now that I see it may be focused on app development only, I don't care about it, as honestly getting computers compliant is a l

> I was ready to get more info, now that I see it may be focused on app development only, I don't care about it, as honestly getting computers compliant is a lot easier than getting humans and processes compliant. If you're not just focused on development, this reinforces the website problem. Same situation. I was just about to write this exact comment. I don't need a platform, AWS already has plenty of services that when set up correctly are fine. And AWS already has the checklist they're showing as the main demo implemented. You can security scan your services and get exactly this checklist. Basic technical compliance is not the hard part! It's everything else. Like the nice doctor who sends an image by email to investigate a scan after work who ends up being a problem. Or people who share passwords because they can't be bothered to get everyone signed up for a resource. Or someone making a bad decision about what is or isn't PHI because they don't understand the rules clearly. Or the creepy person who searches for their neighbour's medical records, etc. > "How can I show my customers that I’m HIPAA compliant?" Again, it's 2024, no one cares about badges, they want BAAs and compliance reports. In my experience no customers will ever ask if you're HIPAA compliant. This is something that comes up in a lawsuit or when a regulator visits. If anything, security stuff scares people away, best to say nothing. > A more detailed website would change that a lot. Agreed, the idea that HIPAA will be one click away and we never have to think about it again is silly. Because the website is so thin it comes across as written by someone who has never dealt with HIPAA. It's also not clear to me how this whole setup works with legal. You cannot outsource compliance. When the state comes knocking one day with a big fine because there's a breach or mistake in whatever Delve is doing, we can't throw up our arms and say, well we have this dashboard that says everything is fine.

selinkocalar 3y ago
> Basic technical compliance is not the hard part! It's everything else. We totally agree. And to clarify, we don't just provide the technical compliance checklist (AWS Audit Manager already has all that), we provide the comprehensive list of tasks and policies that you need to put in place to be prepared for a complete audit. This spans terraform for technical infra setup all the way to 20+ legal policies (BC/DR Policies, Asset Management Policies, Access Control Policies, etc.) > In my experience no customers will ever ask if you're HIPAA compliant. For startups and earlier companies, being HIPAA compliant (whether it's a compliance badge on the footer of your website or a compliance report that you send to customers) is immensely helpful in the sales process. It signals credibility and trust. Sometimes this can be the difference between getting a sales call vs. not. > A more detailed website would change that a lot. We completely agree. We're rolling out a new version of the website taking to heart all the feedback you've given and will reply here in the coming days once we've pushed the updates. > It's also not clear to me how this whole setup works with legal. We're not replacing your legal counsel nor are we guaranteeing compliance. We're giving you the tools to be compliant that we've revised and refined with the help of auditors. At the end of the day, if you intentionally deploy an application that posts people's medical data to Twitter or you leave your computer unlocked on a subway, we can't take liability for that :)

selinkocalar 3y ago

> Basic technical compliance is not the hard part! It's everything else. We totally agree. And to clarify, we don't just provide the technical compliance checklist (AWS Audit Manager already has all that), we provide the comprehensive list of tasks and policies that you need to put in place to be prepared for a complete audit. This spans terraform for technical infra setup all the way to 20+ legal policies (BC/DR Policies, Asset Management Policies, Access Control Policies, etc.) > In my experience no customers will ever ask if you're HIPAA compliant. For startups and earlier companies, being HIPAA compliant (whether it's a compliance badge on the footer of your website or a compliance report that you send to customers) is immensely helpful in the sales process. It signals credibility and trust. Sometimes this can be the difference between getting a sales call vs. not. > A more detailed website would change that a lot. We completely agree. We're rolling out a new version of the website taking to heart all the feedback you've given and will reply here in the coming days once we've pushed the updates. > It's also not clear to me how this whole setup works with legal. We're not replacing your legal counsel nor are we guaranteeing compliance. We're giving you the tools to be compliant that we've revised and refined with the help of auditors. At the end of the day, if you intentionally deploy an application that posts people's medical data to Twitter or you leave your computer unlocked on a subway, we can't take liability for that :)