3 ms·

I don't quite see the reason for this with the cloud. Amazon has a whitepaper on AWS with HIPAA and I've seen some startups give presentations about their imple

I don't quite see the reason for this with the cloud. Amazon has a whitepaper on AWS with HIPAA and I've seen some startups give presentations about their implementation in the AWS conference. There's some misinformation on your website, "HIPAA compliance is costly and hard to get right" It's not. It's almost cheaper to sign an EA with Microsoft and use Azure (who by the way also sign a BAA) than your pricing. I also couldn't find any mention of what redundancy you use or any mention of uptime. HIPAA compliance is basically encryption + access control + logs + redundancy with a few other simple features. All of which are easily accomplished with AWS or Azure. BAAs between you and your hosting provider are not necessary unless you have access to the PHI (Amazon doesn't, Azure does). The biggest red flag to me is that this doesn't (as one might assume) absolve the developer from liability / responsibility. If it were to come to light that your business is (I don't think any of these things about you) corrupt/poorly run/hacked/breached/etc. the developer is then liable to immediately remedy the situation which may include being required to move elsewhere. That would be a huge disruption to any service as they would have to build a system from scratch while somehow still operating. This would be the only reason I would switch my apps from AWS to your service but unfortunately this is not the case. The fact also remains any HIPAA violation would be more likely in the implementation of the webapp (i.e. allowing images to be cached) and not in the storage of it. Leaks of encrypted PHI aren't even an issue with HIPAA. You have the issue of being new and without a reputation while I can still be liable for your mistakes. While you have insurance it's not really feasible to sue someone as a startup. Anyone not a startup would find your pricing way too expensive. Amazon whitepaper: https://aws.amazon.com/about-aws/whats-new/2009/04/06/whitepaper-hipaa/ https://aws.amazon.com/about-aws/whats-new/2009/04/06/whitep... re:Invent presentation: http://www.slideshare.net/ControlGroup/aws-reinvent http://www.slideshare.net/ControlGroup/aws-reinvent TL;DR: BAAs do not remove liability, HIPAA compliance isn't nearly as complex as other regulatory bs, AWS and Azure are both easily made HIPAA compliant.

jason_wang 13y ago
Howdy - We think of ourselves as Parse for healthcare sites/apps/devices. One can absolutely build their own Parse to power their own stack, but it may not be time/resource effective. Behind the scene, among other things, we provide unique object encryption and automatic object re-key and re-encryption -- mechanisms one would have to be custom build for a homegrown HIPAA environment (event on AWS). We make sure the Protected Health Information our customers collect is always in compliance with HIPAA despite the ever changing healthcare regulatory landscape. But you are absolutely right. We do not absolve the developers/covered entities from all HIPPA liabilities and responsibilities. We just take care of one aspect of HIPAA so they can focus on other things.
- deleted 13y ago
  [deleted]
amitmathew 13y ago
It's important to keep in mind that Amazon's HIPAA whitepaper is horribly out-of-date in light of the new Omnibus rules that were passed earlier this year: http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/index.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/... The new regulations require you to sign a BAA with Amazon if you are storing PHI on their servers. Having gone through the process of building a "HIPAA-compliant" product, I wouldn't underestimate the extra work that HIPAA requires. The encryption requirements really limit the third parties you can work with, so you often have to end up building a lot of your own infrastructure and software.

jason_wang 13y ago

Howdy - We think of ourselves as Parse for healthcare sites/apps/devices. One can absolutely build their own Parse to power their own stack, but it may not be time/resource effective. Behind the scene, among other things, we provide unique object encryption and automatic object re-key and re-encryption -- mechanisms one would have to be custom build for a homegrown HIPAA environment (event on AWS). We make sure the Protected Health Information our customers collect is always in compliance with HIPAA despite the ever changing healthcare regulatory landscape. But you are absolutely right. We do not absolve the developers/covered entities from all HIPPA liabilities and responsibilities. We just take care of one aspect of HIPAA so they can focus on other things.

deleted 13y ago
[deleted]

amitmathew 13y ago

It's important to keep in mind that Amazon's HIPAA whitepaper is horribly out-of-date in light of the new Omnibus rules that were passed earlier this year: http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/index.html http://www.hhs.gov/ocr/privacy/hipaa/administrative/omnibus/... The new regulations require you to sign a BAA with Amazon if you are storing PHI on their servers. Having gone through the process of building a "HIPAA-compliant" product, I wouldn't underestimate the extra work that HIPAA requires. The encryption requirements really limit the third parties you can work with, so you often have to end up building a lot of your own infrastructure and software.