Hacker News Reader

Comment by snuxoll | Hacker News Reader

Work for a medical billing company owned by a physician group, had somebody in from Google a month or two ago wanting access to a stream of patient data from us in exchange for building some software for us. There was absolutely no detail on what they thought they could build, just that they would see what they could come up with after we started feeding them data.

The architect on our team immediately began laughing in the meeting, as it's clear that Google has absolutely zero idea how HIPAA works.

View on HN

You know what the really stupid thing is? Looking at the attack surfaces and data values and compromise histories, and having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat. If you're saying that Google would need to learn about a brand new truckload of paperwork, sure. But HIPAA is neither necessary nor sufficient for privacy or security.

The problem is HIPAA doesn't allow one to share data without a reason - in fact it's only to be ACCESSED with a reason even by those with privileges to do so. I would trust Google to keep data safe, but brazenly asking for data without a defined use case is in blatant disregard for the regulations we operate under.

Like I said, I suspect this is mostly a question of learning new paperwork. My experience at Google has been that the security and privacy tooling is granular enough that access can be proposed, vetted, authorized, controlled, and monitored at the level of individual build numbers of individual binaries. I'd guess that the casual assumption was that there'd be a "defined use case" step but that it'd be covered by existing internal procedures, and I'd also guess that in any sane world it would be covered.

(This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)

> (This is, honestly, one of the reasons I call the entire thing stupid and trust HIPAA so little - at that cloud EMR company, every one of the 500+ devs must have had something like a perpetually-active use case of "debugging the product". If it weren't for the fact that I know that that company made it through audits I'd have phoned HHS my first month.)

So you're saying a valid use case to access patient data under HIPAA is for debugging the product? That sounds incredibly unlikely; even at my job we use faked data for this kind of thing. Can you point me to a source for your claim?

I wrote up a bit reply to clarify, but now I'm looking and thinking about it for the first time in a few years, with four years of job experience instead of four days, and realizing that I probably need to be showing this to a lawyer. The "learn to SQL" exercises directed me to manually inspect individual rows in the prod customer database. Even with the managers and senior devs all assuring me that it was okay and the company having survived for twenty years without being fined into oblivion, this is just... unbelievable. :/

> having been inside Google to see how it treats PII and been inside a cloud EMR provider to see how it treated PHI, I'd move my data out of that EMR and into Google in a heartbeat

I'd prefer to not have any of my data in the cloud, or with Google, or in any internet connected system. Seems that's not a choice however.

I've had enough medical problems and paperwork fuckups to be damned thankful that my medical records aren't on paper. And I worked for a couple years on one of the EMRs that "protects" my data. Yes, the situation could be better. It could also be worse, and in ways much more immediate and dramatic than the usual privacy issues.

...Google definitely understands how HIPAA works. GCP and G Suite both have HIPAA compliance to varying degrees. I don't think that person had any chance of getting clearance to do that from the G side, less your side.

From a G Suite / GCP point of view they really only have to worry about the HIPAA Security Rule, most of which can be punted off on the client (they need to audit and control access to the platform, proper breach notifications and a BAA - the rest is mostly up to the client).

Collecting patient health records starts bringing the HIPAA Privacy Rule into play, which they have zero experience with.

Fair enough, but the other statement I still stand by: I don't think that deal would've been signed off on regardless. My impression from working here is that pretty much any use of any data goes through a fairly rigorous review process. I'm sure there was a point in time when that wasn't the case, but today it sure seems to be.

If the guy is high enough up in the hierarchy, there's a good chance that he can sign off on even illegal things.

Looking at how Google is handling the GDPR, for example, there's just as well plenty obvious violations that someone had to sign off on and that are gonna cost them a few billions once they can't drag the lawsuits out any longer. In the meantime, though, they're very likely making enough money to offset that, which is why executives can sign off on illegal things in the first place. It's just a basic risk analysis in the end.

I only take objection to the idea that because one employee in a company made a proposal that was not legal, that this is somehow representative of a company is ran. Engineers aren't lawyers, that's why there's a process for them to speak to lawyers in any sane large company, usually requiring approval for things that are especially important like handling sensitive data. Google isn't even special here.

British hospitals have already given them the data. They didn’t even have to pay. Some of the data is annotated meaning if you wanted supervised learning data it’s primo stuff. All free.

Having worked on both sides of this, I find this account unlikely at best.

If anything, the medical side is generally a horror show, especially at physician owned groups.

Reply on news.ycombinator.com