Comment by yellowapple | Hacker News Reader

Comment by yellowapple | Hacker News Reader

Parent Full thread

I used to work in a hospital IT department :)

> I know from experience that every hospital is different ... my gut tells me the application will actually need a local database in each center, within the hospital network, which periodically replicates up to central cloud database

What data are you trying to store? Pretty much every EMR/EHR system nowadays speaks HL7; if your goal is to integrate with those EMR systems, then your own application could circumvent a lot of issues by speaking HL7 as well. Of course, this only covers certain use cases, hence the question.

> their IT departments range from strict to extremely strict

Eeyup :)

> I am also aware of the HIPAA-compliant PAAS services out there and we may end up using one of those.

You definitely should. Else, be prepared to deploy your own physical servers and provide similar assurances of HIPAA/HITECH compliance. Hospitals already tend to be wary of anything pertaining to patient data living beyond their own networks.

> There's been a lot of talk about healthcare moving to the cloud

For some small clinics, yes, this is somewhat attractive. Once you move into medium and large healthcare organizations, hospitals, etc., however, the desire is almost universally for things to be as self-hosted as possible if they involve PII. Most EMR vendors prioritize local/onsite deployments IIRC (with one notable exception in my experience: CPSI, or "say-pay-ess-eye", as it's more commonly known).

> Am I right to assume that it's nearly impossible to set up a cloud database that is accessed directly from, say, the OR of a hospital?

Not impossible. Just excruciatingly difficult, with difficulty scaling exponentially with the size of the hospital. :)

Super helpful response. Thank you!

> What data are you trying to store?

A couple of fields could be imported by integrating with existing EMR/EHR through HL7, but at this early stage I don't envision any integration and these fields will be input manually. The MVP works this way, for example (and has been used in a few hospitals).

> You definitely should. Else, be prepared to deploy your own physical servers

Does this mean you've seen off-site hosted apps using these HIPAA PAAS providers being used by hospitals "in production" (so to speak)?

> Not impossible. Just excruciatingly difficult, with difficulty scaling exponentially with the size of the hospital. :)

Is this regardless of using a HIPAA-compliant PAAS, or only in the case where we don't? I'm already dreading the answer ;)

> A couple of fields could be imported by integrating with existing EMR/EHR through HL7, but at this early stage I don't envision any integration and these fields will be input manually. The MVP works this way, for example (and has been used in a few hospitals).

In that case, yeah, hospitals will tend to differ very significantly; once you go beyond the HL7 world, any hope of a standardized interface goes out the window. Expect hospitals to run their own copies of your database in that case, and expect them to be very strict about what access you get.

> Does this mean you've seen off-site hosted apps using these HIPAA PAAS providers being used by hospitals "in production" (so to speak)?

I've yet to see a HIPAA-complaint PaaS vendor in use by an actual hospital, but it's worth mentioning that at least one such vendor - Catalyze - claims Blue Shield and the VA hospitals as customers.

I have, however, seen off-site EMRs in use by hospitals, particularly (as I mentioned previously) CPSI (though the hospital I worked for - which was, at the time, apparently CPSI's largest customer - eventually strongarmed them into providing support for an onsite server). Such EMRs are typically hosted on hardware owned and operated by the vendor.

Most hospital districts, multi-facility providers, etc. will opt for a single installation of an EMR throughout all their locations. Usually this will be facilitated using a provider-wide VPN, so that'll probably help your particular usecase somewhat. In most cases, this is as close as you're going to get to "off-site" once you get to larger providers, though - again - deviations from this are not entirely unheard of.

> Is this regardless of using a HIPAA-compliant PAAS, or only in the case where we don't? I'm already dreading the answer ;)

HIPAA-compliant PaaS products are pretty new, so this answer will undoubtedly change over time, but currently, such a PaaS will only flatten that expontential curve to maybe a linear one. Small hospitals and clinics will certainly be interested, since many of them dread having to manage any sort of IT infrastructure, to the point of even contracting out to their competitors in some cases (as I witnessed firsthand) instead of trying to do anything themselves. Once they've gone forward with their own IT department, however, the chances of even a HIPAA-compliant PaaS being deemed suitable starts to dwindle, and emphasis on self-hosted solutions grows stronger and stronger.

A number of companies are hosted on Aptible that are not only in production, but doing well. The same goes for Catalyze.

In general, though, yes, whether or not the solutions will suffice comes down to the arbitrary decision of an administrator who probably doesn't understand the underlying tech issues. That will start changing soon though.

Reply on news.ycombinator.com