Hacker News Reader

Comment by __derek__ | Hacker News Reader

Amazon has been HIPAA-compliant for years at this point. Even Alexa has been since 2019.[1]

[1]: https://developer.amazon.com/blogs/alexa/post/ff33dbc7-6cf5-...

This website basically says that 6 companies use Alexa, for HIPAA purposes - that they are allowing CEs and BAs access to an environment that Amazon attests is capable of being HIPAA compliant. That's a long way from the statement that "Amazon is HIPAA compliant".

>>>>Amazon Alexa is currently providing a HIPAA eligible environment to select skill developers as part of an invite-only program in the U.S. In the future, we expect to enable additional developers to access this capability to build healthcare skills, allowing more customers to access healthcare services more conveniently using voice. If you are interested in getting updates on our HIPAA eligible environment for Alexa skills, click here.

The link was intended to date the Alexa comment ("since 2019"), but the placement was ambiguous. Anyway, you're correct that I was lazy on wording.

> Even Alexa has been [HIPAA-compliant] since 2019.

And most major sites still allowing your PII to go to 100 direct third parties and 4000 indirect parties are GDPR compliant.

Regulation compliant doesn’t mean what most people think it means.

Specifically it means that the company found a way to comply with the letter of the regulation, and that's it.

What it actually really means is simply that Amazon is willing to sign a Business Associate Agreement with HIPAA covered entities for certain services, so that it is possible for the covered entity to use Amazon services while themselves meeting (one particular aspect of) HIPAA regulatory compliance.

At least, that is what it seems to mean given that the support for the claim was a link to Amazon’s description of certain services as HIPAA-eligible, which is Amazon’s term for services they are willing to sign a BAA for.

Sorry, I didn't follow the connection to the quoted sentence. Can you explain?

Compliant doesn't mean what people think it means or do you mean people don't know what the regulation says?

>Regulation compliant doesn’t mean what most people think it means.

That is the bane of my existence.

Reply on news.ycombinator.com