2 ms·

As someone who has been in healthcare IT for maybe 10 years, comfortable with HIPAA HITECH, SAS70, etc., one thing I took a pause at was: > Yes! HIPAA auditors

As someone who has been in healthcare IT for maybe 10 years, comfortable with HIPAA HITECH, SAS70, etc., one thing I took a pause at was: > Yes! HIPAA auditors have reviewed Delve to ensure that we cover HIPAA requirements. To me, the word 'review' is doing a bit of heavy lifting. There's a lot of self-attestation in the HIPAA world, a lot of policies and processes - but to my understanding (and forgive me if it is flawed), any actual auditing is on specific implementation, not generalized. I think your statement is accurate, to be clear - but I think the concern I had was that someone less nuanced or experienced might read something that isn't there into it - i.e. "our tooling has been audited". (Mind you, I also think that someone "less nuanced or experienced" probably shouldn't be heading up a PHI solution, so maybe self-selecting). Also: > Our infrastructure has been vetted by cybersecurity and DevOps experts from AWS, Google Cloud, and more. Similarly, this heavily implies that AWS has done some attestation on your product, which I doubt. For one, in my experience they only partner with compliance partners, and will only attest to their products (and not even all of them).

selinkocalar 3y ago
Glad you pointed these out! Regarding your first point, we've partnered with auditors at Insight Assurance. We've worked with them to map our compliance workflow, infra setup, and controls list with their auditing controls list. This lets us ensure that our compliance tool meets the standards necessary for a HIPAA audit as well as general security best practices. Regarding your second point, we've put our infrastructure configuration through multiple rounds of review with AWS architects that we are working with through YC, with an exited DevOps engineer/founder that we've hired onto our own team, and with our own technical background from MIT. Of course, we have no official attestation from AWS. We've done a lot of due diligence in battle-hardening our infra setup (one of our clients receives 3M+ postgres requests an hour, which we are able to support).

selinkocalar 3y ago

Glad you pointed these out! Regarding your first point, we've partnered with auditors at Insight Assurance. We've worked with them to map our compliance workflow, infra setup, and controls list with their auditing controls list. This lets us ensure that our compliance tool meets the standards necessary for a HIPAA audit as well as general security best practices. Regarding your second point, we've put our infrastructure configuration through multiple rounds of review with AWS architects that we are working with through YC, with an exited DevOps engineer/founder that we've hired onto our own team, and with our own technical background from MIT. Of course, we have no official attestation from AWS. We've done a lot of due diligence in battle-hardening our infra setup (one of our clients receives 3M+ postgres requests an hour, which we are able to support).