3 ms·

I can't quite figure out why a HIPAA compliant data storage service is a big deal... Isn't this just a thin encryption layer on top of Mongo? I feel like I cou

I can't quite figure out why a HIPAA compliant data storage service is a big deal... Isn't this just a thin encryption layer on top of Mongo? I feel like I could replicate this in ~100 lines of Node.

zrail 13y ago
The service itself is not a big deal. The contracts that they're willing to sign are a very big deal. I've never had to do it before but my understanding is that getting vendors to sign those BAA contracts and get the indemnity insurance they offer is not trivial.
hendi_ 13y ago
Hint: As with PCI compliance (for credit card data), the hard thing with HIPAA compliance isn't the code but all the non-technical stuff. Legal stuff with regulations, validations, insurance, audits...
famousactress 13y ago
There's legal red tape that can matter, for one thing. Any third party you use for this sort of thing potentially needs to sign a Business Associates Agreement with you that ties them in responsibility to your commitment to HIPAA compliance with your users... So there's at least some value to add in being willing to take on that level of legal responsibility. There's also some value in a service run by folks who know the ins-and-outs and can help abstract or educate users. I meet lots of folks who want to write apps for healthcare but are terrified to wade into the murky regulatory waters. I've no experience with this particular service, but I do think there's room for vendors like this. [background: developer in healthcare for 10+ years]
daigoba66 13y ago
I don't think it's a big deal necessarily. First, "HIPAA Compliant" is mostly a marketing term as there is no certification, like for things like PCI. The main point of HIPAA is having policies in place that help prevent the unauthorized disclosure of PHI and track/trace authorized disclosure for auditing purposes. To make these policies effective you often need a BAA signed with vendors that can receive/store PHI, and many/most SaaS/PaaS companies are unable to do this. More details: http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.html http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.h...
jason_wang 13y ago
It's a few more lines of code more complicated that that :) In all seriousness, we can give a talk on software security, encryption algorithms and network security with the setup we've created. To do it right, every system in our platform is segregated where one system doesn't see another -through software and network level security. Plus every piece of data is uniquely encrypted with rotating keys (that's kept isolated from the encrypted data). The level of security is like the Secret Service vs. Paul Blart the mall cop. We are in the middle of writing a blog post about how we harden our platform. Stay tuned.
- christiangenco 13y ago
  Noted. I'll be looking out for it!

I can't quite figure out why a HIPAA compliant data storage service is a big deal... Isn't this just a thin encryption layer on top of Mongo? I feel like I could replicate this in ~100 lines of Node.

zrail 13y ago

The service itself is not a big deal. The contracts that they're willing to sign are a very big deal. I've never had to do it before but my understanding is that getting vendors to sign those BAA contracts and get the indemnity insurance they offer is not trivial.

hendi_ 13y ago

Hint: As with PCI compliance (for credit card data), the hard thing with HIPAA compliance isn't the code but all the non-technical stuff. Legal stuff with regulations, validations, insurance, audits...

famousactress 13y ago

There's legal red tape that can matter, for one thing. Any third party you use for this sort of thing potentially needs to sign a Business Associates Agreement with you that ties them in responsibility to your commitment to HIPAA compliance with your users... So there's at least some value to add in being willing to take on that level of legal responsibility. There's also some value in a service run by folks who know the ins-and-outs and can help abstract or educate users. I meet lots of folks who want to write apps for healthcare but are terrified to wade into the murky regulatory waters. I've no experience with this particular service, but I do think there's room for vendors like this. [background: developer in healthcare for 10+ years]

daigoba66 13y ago

I don't think it's a big deal necessarily. First, "HIPAA Compliant" is mostly a marketing term as there is no certification, like for things like PCI. The main point of HIPAA is having policies in place that help prevent the unauthorized disclosure of PHI and track/trace authorized disclosure for auditing purposes. To make these policies effective you often need a BAA signed with vendors that can receive/store PHI, and many/most SaaS/PaaS companies are unable to do this. More details: http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.html http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.h...

jason_wang 13y ago

It's a few more lines of code more complicated that that :) In all seriousness, we can give a talk on software security, encryption algorithms and network security with the setup we've created. To do it right, every system in our platform is segregated where one system doesn't see another -through software and network level security. Plus every piece of data is uniquely encrypted with rotating keys (that's kept isolated from the encrypted data). The level of security is like the Secret Service vs. Paul Blart the mall cop. We are in the middle of writing a blog post about how we harden our platform. Stay tuned.

christiangenco 13y ago
Noted. I'll be looking out for it!