7 ms·

https://www.truevault.com/ https://www.truevault.com/ TrueVault is a HIPAA compliant data backend for apps, devices, and sites. Developers use TrueVault so the

https://www.truevault.com/ https://www.truevault.com/ TrueVault is a HIPAA compliant data backend for apps, devices, and sites. Developers use TrueVault so they can develop healthcare apps without building out their own HIPAA compliant infrastructure. You access data in TrueVault via our API and native clients. Think of TrueVault as Stripe for confidential patient data. You use Stripe to store credit card data so that you are PCI compliant. Our customers use TrueVault to store protected health information (PHI) so that they are HIPAA compliant. It’s cool because new healthcare applications are paring back their feature sets so that they don’t have to be HIPAA compliant. TrueVault helps solve this problem, and prevents legislation from hindering innovation. TrueVault will handle HIPAA so that entrepreneurs can focus on improving the quality of care for millions. Also cool because TrueVault takes care of all of the technical requirements mandated by HIPAA. HIPAA compliant hosting providers (AWS, FireHost, Rackspace) only provide a HIPAA ready environment. You still have to spend the dev time and money to build your own application stack in order to comply with HIPAA.

jjsz 13y ago
This is how I read this: HIPAA data backend as a service. Can also connect to Stripe for PHI and credit card storage. Most companies are not HIPAA. HIPAA API. Other companies are not HIPAA. We handle HIPAA. We know HIPAA. HIPAA (AWS, FireHost, Rackspace) is not enough. HIPAA. HIPAA! Visit truevault dot com: recent blog entries- Do I Need To Be HIPPA Compliant?
- trey_swann 13y ago
  Pretty close. Stripe is really just used for comparison purposes. Using Stripe makes you PCI compliant, and using TrueVault makes you HIPAA compliant. Also it demonstrates that TrueVault is not a consumer facing document storage solution (not a HIPAA compliant Dropbox). You access data in TrueVault via our API and native clients. Bottom line, if your application needs to be HIPAA compliant it’s a pain. If you push your protected health information (PHI) to TrueVault, then you don’t have to spend months and months developing your own HIPAA compliant infrastructure.
jph 13y ago
Excellent. Two of my clients need exactly this service. We have the pain point you describe, i.e. needing to build out AWS, Rackspace, etc. Currently we build custom AWS images, however we'd much rather pay for a HIPAA stack. Kudos!
- trey_swann 13y ago
  Many thanks! Appreciate the kind words. We offer a 30-day free trial, so you can play around with our API without entering a credit card. Caveat -- don’t send us any real PHI until we sign a BAA. Please feel free to test it out, and if you have any questions shoot me an email. trey@truevault.com We get to see a wide variety of use cases, happy to share our experiences.
chasb 13y ago
What's a use case for this?
- jph 13y ago
  My client's use case: we have multiple hospitals that need to share confidential information, for example a patient intake survey that is essentially a typical web form. We need somewhere to store that data. Building the AWS site to do this took upwards of 1000 person-hours to figuring out HIPAA-compliance issues. This will continue to be an ongoing cost for us, because HIPAA is an ongoing law and it changes sometimes. It takes substantial auditing time and money. TrueVault would save us all that.
  - trey_swann 13y ago
    That’s a great example. Thank you!
- trey_swann 13y ago
  Another use case: apps/sites/devices that offer tools to help people track various health-related statistics. Consumer-originated data, even though it is health data, is not protected health information (PHI) as covered by HIPAA. But, when that health data is shared with a Covered Entity (a doctor, hospital, insurance plan, or other HIPAA-defined CE) then it becomes PHI. And, the app handling the PHI needs to be HIPAA compliant. People want information, not data. When an app takes health data and feeds it up to a doctor for diagnosis, analysis, advice, or treatment, then that data becomes PHI and your app needs to be HIPAA compliant.
  - chasb 13y ago
    You said that TrueVault will "handle HIPAA" and that "using TrueVault makes you HIPAA compliant." I don't see how those claims are true. If the developer is a business associate, they're still required to have a risk analysis, policies, and training. If they're not a business associate, they don't need to be compliant. So I guess I'm not seeing how TrueVault helps a developer avoid becoming a business associate. jph's case is marginal - if the covered entities all sign BAAs with TrueVault, maybe the developer can argue that they do not "create, receive, maintain, or transmit" PHI. Good luck arguing that with the covered entity, btw.
bm98 13y ago
So are you going to sign Business Associate Agreements with your customers? They won't be HIPAA compliant otherwise, under the latest HITECH rules. That's where the analogy to PCI breaks down.
- trey_swann 13y ago
  Yes, TrueVault is signing Business Associate Agreements (BAAs) with our customers. TrueVault is also the first to cover customers under a comprehensive Privacy/Data Breach Insurance policy. As a result, TrueVault is able to indemnify our customers for, from, and against regulatory fines and the cost of breach remediation.
- deleted 13y ago
  [deleted]
spoiledtechie 13y ago
LOVE. Thank you. Might sign up soon.
- trey_swann 13y ago
  Thank you! That's very nice to hear. Let me know if you have any questions. Here to help. trey@truevault.com

jjsz 13y ago

This is how I read this: HIPAA data backend as a service. Can also connect to Stripe for PHI and credit card storage. Most companies are not HIPAA. HIPAA API. Other companies are not HIPAA. We handle HIPAA. We know HIPAA. HIPAA (AWS, FireHost, Rackspace) is not enough. HIPAA. HIPAA! Visit truevault dot com: recent blog entries- Do I Need To Be HIPPA Compliant?

trey_swann 13y ago
Pretty close. Stripe is really just used for comparison purposes. Using Stripe makes you PCI compliant, and using TrueVault makes you HIPAA compliant. Also it demonstrates that TrueVault is not a consumer facing document storage solution (not a HIPAA compliant Dropbox). You access data in TrueVault via our API and native clients. Bottom line, if your application needs to be HIPAA compliant it’s a pain. If you push your protected health information (PHI) to TrueVault, then you don’t have to spend months and months developing your own HIPAA compliant infrastructure.

jph 13y ago

Excellent. Two of my clients need exactly this service. We have the pain point you describe, i.e. needing to build out AWS, Rackspace, etc. Currently we build custom AWS images, however we'd much rather pay for a HIPAA stack. Kudos!

trey_swann 13y ago
Many thanks! Appreciate the kind words. We offer a 30-day free trial, so you can play around with our API without entering a credit card. Caveat -- don’t send us any real PHI until we sign a BAA. Please feel free to test it out, and if you have any questions shoot me an email. trey@truevault.com We get to see a wide variety of use cases, happy to share our experiences.

chasb 13y ago

What's a use case for this?

jph 13y ago
My client's use case: we have multiple hospitals that need to share confidential information, for example a patient intake survey that is essentially a typical web form. We need somewhere to store that data. Building the AWS site to do this took upwards of 1000 person-hours to figuring out HIPAA-compliance issues. This will continue to be an ongoing cost for us, because HIPAA is an ongoing law and it changes sometimes. It takes substantial auditing time and money. TrueVault would save us all that.
- trey_swann 13y ago
  That’s a great example. Thank you!
trey_swann 13y ago
Another use case: apps/sites/devices that offer tools to help people track various health-related statistics. Consumer-originated data, even though it is health data, is not protected health information (PHI) as covered by HIPAA. But, when that health data is shared with a Covered Entity (a doctor, hospital, insurance plan, or other HIPAA-defined CE) then it becomes PHI. And, the app handling the PHI needs to be HIPAA compliant. People want information, not data. When an app takes health data and feeds it up to a doctor for diagnosis, analysis, advice, or treatment, then that data becomes PHI and your app needs to be HIPAA compliant.
- chasb 13y ago
  You said that TrueVault will "handle HIPAA" and that "using TrueVault makes you HIPAA compliant." I don't see how those claims are true. If the developer is a business associate, they're still required to have a risk analysis, policies, and training. If they're not a business associate, they don't need to be compliant. So I guess I'm not seeing how TrueVault helps a developer avoid becoming a business associate. jph's case is marginal - if the covered entities all sign BAAs with TrueVault, maybe the developer can argue that they do not "create, receive, maintain, or transmit" PHI. Good luck arguing that with the covered entity, btw.

bm98 13y ago

So are you going to sign Business Associate Agreements with your customers? They won't be HIPAA compliant otherwise, under the latest HITECH rules. That's where the analogy to PCI breaks down.

trey_swann 13y ago
Yes, TrueVault is signing Business Associate Agreements (BAAs) with our customers. TrueVault is also the first to cover customers under a comprehensive Privacy/Data Breach Insurance policy. As a result, TrueVault is able to indemnify our customers for, from, and against regulatory fines and the cost of breach remediation.
deleted 13y ago
[deleted]

spoiledtechie 13y ago

LOVE. Thank you. Might sign up soon.

trey_swann 13y ago
Thank you! That's very nice to hear. Let me know if you have any questions. Here to help. trey@truevault.com