3 ms·

Does an app like this need to be HIPAA-compliant? I would guess that many people would consider building an app like this without thinking too much about HIPAA

by japhyr 12y ago

Does an app like this need to be HIPAA-compliant? I would guess that many people would consider building an app like this without thinking too much about HIPAA. "We're not doctors, we're just building an app that will help people manage their anxiety." But the app clearly asks questions of its users that are focused on mental health. If a situation arises in which a user has a bad experience related to how their information was shared, it seems quite reasonable to consider whether their right to medical privacy was violated. This seems particularly important with the unfortunate stigma associated with mental health issues. I don't ask this just to nitpick. I'm looking at building some projects related to education, and in education there's a comparable act called FERPA - Family Educational Rights and Privacy Act. It seems convenient to ignore these kind of regulations when building projects that are meant to be really helpful to everyone, but once a project like this takes off compliance with privacy acts seems critical. I'm quite curious to hear from the developers what their take on HIPAA has been.

beermann 12y ago
This is a great question. Technically, we don't store Protected Health Information ("Personal health information (PHI), also referred to as protected health information, generally refers to demographic information, medical history, test and laboratory results, insurance information and other data that is collected by a health care professional to identify an individual and determine appropriate care."). Everything is self-reported in Pacifica. That said, we treat our data as if it were PHI. We have a Business Associates Agreement signed with AWS, and take all of the precautions they require for an app that would claim it is HIPAA compliant. Technically, we could claim that we are HIPAA compliant, as we don't store PHI. But we didn't want to say that just for the sake of saying that. The bigger question, in my mind, is about whether or not a situation would arise as you mention. The FDA recently provided a little more clarity on some of this (http://mobihealthnews.com/39775/fda-clarifies-the-line-between-wellness-and-regulated-medical-devices/ http://mobihealthnews.com/39775/fda-clarifies-the-line-betwe...). Specifically, Pacifica seems to fall outside regulation as it "Claims to promote relaxation or manage stress when there is no reference to anxiety disorders or other reference to a disease or condition." We try to be pretty careful about the language that we use. We don't mention things like Generalized Anxiety Disorder, Panic Disorder, OCD, etc. The truth is that it still seems like a grey area. That same article mentions that we should not claim that we treat anxiety if we want to stay unregulated. I think that we're on the fence here. In the future, we will go after FDA clearance in any case. We just need the means to do so.
- japhyr 12y ago
  The truth is that it still seems like a grey area. That same article mentions that we should not claim that we treat anxiety if we want to stay unregulated. I think that we're on the fence here. In the future, we will go after FDA clearance in any case. We just need the means to do so. This sounds perfectly honest, and I appreciate you acknowledging that. I wonder if some of the information shared through the app would start to become "medical history". If you're being careful about your language to avoid clinical terms, but the substance of what your users are sharing is mental health related, I wonder if someone could make a case that you are actually collecting a medical history. But IANAL, so I don't know how that would play out.
- Deebot 12y ago
  What I'm getting from everything you're saying, is this... "We're carefully avoiding anything that might make us comply with regulations that could potentially get in the way of our harvesting of your thoughts and mental health status"
- foolinaround 12y ago
  Again, details such as these ( precautions taken ) would be valuable on your site. To repeat : the privacy policy and "about" sections need a lot of work considering the nature of this app.
  - beermann 12y ago
    That's fair. As it's our launch day, there are a few things like this that we'll get in place as quickly as we can. For what it's worth until we can do that, here's a quick rundown: all data is transmitted over https. While we use Elastic Load Balancers we don't terminate SSL at the load balancer so data makes to our web servers before being decrypted. Any audio recordings are stored encrypted in S3, and our RDS instances are also encrypted. Everything runs in a Virtual Private Cloud. Each service (ELB, EC2 instances, RDS, S3) runs in its own security group with IAM user roles that can be removed and reissued if needed. We'll try to get this information up on the site fairly soon.
- markolschesky 12y ago
gqvijay 12y ago
My take on it is HIPAA is meant to protect your privacy which is great BUT we have to make sure it doesn't impede progress in mental health. I am no expert but there has to be incredible amount of information based on studying the data. This is especially true in mental health. Personally, I am not a fan of a general statement like "don't collect any data". As a patient, I am totally ok if a system collects data ON me BUT never ABOUT me. In another words, the data should in no way be identifiable. That way, we continue to make progress while maintaining privacy.
- DanBC 12y ago
  England has electronic records. They planned to implement an anonymised database for research - care.data (care dot data). A previous version of that scheme, run under different rules, saw anonymous patient data being sold to insurance companies. (It's now a criminal offence to sell off the data.) That stupid decision has led to delays. http://www.bbc.co.uk/news/health-26253440 http://www.bbc.co.uk/news/health-26253440 http://www.bbc.co.uk/news/health-26239532 http://www.bbc.co.uk/news/health-26239532 http://www.bbc.co.uk/news/health-26347026 http://www.bbc.co.uk/news/health-26347026 http://www.bbc.co.uk/news/health-25919399 http://www.bbc.co.uk/news/health-25919399 etc etc.
0xdeadbeefbabe 12y ago
Although fashionable opinions will differ, I doubt that HIPAA compliance will provide enough benefit to be worth the cost. Is anyone interested in advocating for that side anymore?

by japhyr 12y ago

beermann 12y ago

This is a great question. Technically, we don't store Protected Health Information ("Personal health information (PHI), also referred to as protected health information, generally refers to demographic information, medical history, test and laboratory results, insurance information and other data that is collected by a health care professional to identify an individual and determine appropriate care."). Everything is self-reported in Pacifica. That said, we treat our data as if it were PHI. We have a Business Associates Agreement signed with AWS, and take all of the precautions they require for an app that would claim it is HIPAA compliant. Technically, we could claim that we are HIPAA compliant, as we don't store PHI. But we didn't want to say that just for the sake of saying that. The bigger question, in my mind, is about whether or not a situation would arise as you mention. The FDA recently provided a little more clarity on some of this (http://mobihealthnews.com/39775/fda-clarifies-the-line-between-wellness-and-regulated-medical-devices/ http://mobihealthnews.com/39775/fda-clarifies-the-line-betwe...). Specifically, Pacifica seems to fall outside regulation as it "Claims to promote relaxation or manage stress when there is no reference to anxiety disorders or other reference to a disease or condition." We try to be pretty careful about the language that we use. We don't mention things like Generalized Anxiety Disorder, Panic Disorder, OCD, etc. The truth is that it still seems like a grey area. That same article mentions that we should not claim that we treat anxiety if we want to stay unregulated. I think that we're on the fence here. In the future, we will go after FDA clearance in any case. We just need the means to do so.

japhyr 12y ago
The truth is that it still seems like a grey area. That same article mentions that we should not claim that we treat anxiety if we want to stay unregulated. I think that we're on the fence here. In the future, we will go after FDA clearance in any case. We just need the means to do so. This sounds perfectly honest, and I appreciate you acknowledging that. I wonder if some of the information shared through the app would start to become "medical history". If you're being careful about your language to avoid clinical terms, but the substance of what your users are sharing is mental health related, I wonder if someone could make a case that you are actually collecting a medical history. But IANAL, so I don't know how that would play out.
Deebot 12y ago
What I'm getting from everything you're saying, is this... "We're carefully avoiding anything that might make us comply with regulations that could potentially get in the way of our harvesting of your thoughts and mental health status"
foolinaround 12y ago
Again, details such as these ( precautions taken ) would be valuable on your site. To repeat : the privacy policy and "about" sections need a lot of work considering the nature of this app.
- beermann 12y ago
  That's fair. As it's our launch day, there are a few things like this that we'll get in place as quickly as we can. For what it's worth until we can do that, here's a quick rundown: all data is transmitted over https. While we use Elastic Load Balancers we don't terminate SSL at the load balancer so data makes to our web servers before being decrypted. Any audio recordings are stored encrypted in S3, and our RDS instances are also encrypted. Everything runs in a Virtual Private Cloud. Each service (ELB, EC2 instances, RDS, S3) runs in its own security group with IAM user roles that can be removed and reissued if needed. We'll try to get this information up on the site fairly soon.
markolschesky 12y ago

gqvijay 12y ago

My take on it is HIPAA is meant to protect your privacy which is great BUT we have to make sure it doesn't impede progress in mental health. I am no expert but there has to be incredible amount of information based on studying the data. This is especially true in mental health. Personally, I am not a fan of a general statement like "don't collect any data". As a patient, I am totally ok if a system collects data ON me BUT never ABOUT me. In another words, the data should in no way be identifiable. That way, we continue to make progress while maintaining privacy.

DanBC 12y ago
England has electronic records. They planned to implement an anonymised database for research - care.data (care dot data). A previous version of that scheme, run under different rules, saw anonymous patient data being sold to insurance companies. (It's now a criminal offence to sell off the data.) That stupid decision has led to delays. http://www.bbc.co.uk/news/health-26253440 http://www.bbc.co.uk/news/health-26253440 http://www.bbc.co.uk/news/health-26239532 http://www.bbc.co.uk/news/health-26239532 http://www.bbc.co.uk/news/health-26347026 http://www.bbc.co.uk/news/health-26347026 http://www.bbc.co.uk/news/health-25919399 http://www.bbc.co.uk/news/health-25919399 etc etc.

0xdeadbeefbabe 12y ago

Although fashionable opinions will differ, I doubt that HIPAA compliance will provide enough benefit to be worth the cost. Is anyone interested in advocating for that side anymore?