Hacker News Reader

Comment by doctoboggan | Hacker News Reader

My wife is an MD and I got her using Claude Code for all sorts of tasks adjacent to but not actually generating code that will be used by others. I am quite sure Claude is writing code to accomplish the tasks she asks for, but she doesn't really know or care about that. She also uses Claude for family stuff, she had Claude build us a packing list artifact that helps us pack for our family vacations, and he now manages our address book, friends birthdays, an other family administrivia.

View on HN

This is scary. With tools that Claude offer it is very easy to cross HIPAA line and accidentally send shitton of data to claude

MD is often “Managing Director” when the top level subject refers to Goldman Sachs, et. al.

Also AIUI both claude[0] and chatgpt[1] offer HIPAA compliant BAA’s.

0: https://support.claude.com/en/articles/13296973-hipaa-ready-...

1: https://openai.com/solutions/industries/healthcare/

Ok my bad then. MD I took for medical doctor.

Isn't it crazy that ai companies have private inference but still spy on the consumers.

I don't think it's far fetched to say the reason the subscription discounts $1k of API to $200, is that the data is worth $800.

I would posit that it’s more about market segmentation than the NPV of training on the data but I don’t have enough insider knowledge to make a statement on that matter.

They have ZDR arrangements for this reason

Anthropic’s ZDR agreement is a sieve. It has so many conditions that vest Anthropic with discretion over whether they get to retain data.

Do you think my wife is dumb and doesn't take her job seriously? She is very aware of HIPAA rules and makes sure to steer clear.

> Claude is writing code to accomplish the tasks she asks for

Is this typical behavior with LLMs not just Claude, but you can discourage from doing so by explicitly stating not to use tool or only use knowledge either in the system prompt or user prompt.

LLMs are trained to use tool if they can't solve a problem rather than guessing/hallucinating.

A dumb example is asking to count. As the range grow it'll attempt to write a script or use commands like seq to generate the numbers.

I really hope she’s not using any patient data with it.

Oh she is definitely doing that

Do you know my wife? Why do you think she would put her job in jeopardy and patient data at risk? You seem to have a naive view of doctors and their relationship with technology

There are already HIPAA-compliant AI systems in place. My doctor uses an AI transcription service for her patient interviews.

For sure but how many have account access set up by the doctor’s spouse?

Where did I say I set up her account access? And how would I get it on her computer? No, I told her to request access to Claude Code through her workplace which she did and was granted.

I was using Claude Code yesterday for iterating with Claude Design. At some point it got faster and started producing screenshot PNGs of the canvas locally. I asked it what was up and it said that it wrote a local renderer to simulate the Claude canvas runtime.

To those who are replying with surprise and fear:

I work in healthcare-adjacent tech. You can use Claude with HIPAA/PHI. You need to sign a BAA (Business Associate Agreement). It dictates how Anthropic may use and how they must safeguard the PHI (Private Health Information), including not training on it.

I assure you that Claude and other LLMs are used extensively in healthcare, with PHI access, just about everywhere.

Don't be naive. Don't be alarmist.

If anything, LLM use under these conditions is far more safe than the way most people use LLMs. Engineers who aren't under any regulatory regime like HIPAA are using LLMs without the BAA safeguards, exposing personal data directly to the insecure, shared models, which are now training on all the personal data that's being fed into them. People think their communication with LLMs is private and isolated, but without the BAAs in use by companies under compliance regimes, it's not isolated.

> Don't be naive. Don't be alarmist.

To me it’s the phrasing “I got her using Claude code”. Maybe that means “I helped her set up access through her employer approved AI account” but it’s not exactly that common for such access to be set up by your husband. It just as plausibly means “she’s using the same personal account she’s using for the family tasks I also mentioned”. I don’t see that concern as naive so much as in tune with the way people frequently use tech.

Thank you, I am taken aback by the crazy reaction here. People assume doctors are some sort of tech illiterate luddites who would be throwing around PII left and right if they weren't restrained by us smart programmers?

She takes HIPAA very seriously, and yes she got Claude Code access through her workplace. I did not set up my personal CC account on her work computer and there is no way she would let me (or her corporate controls even if she did...)

who is "he"?

Claude most likely...

From context I assume: Claude. "It" might fit better?

By MD, you surely mean Medicinae Doctor, a.k.a Doctor of Medicine, right?

If it's some other corpo-acronym, I would hope you would define the term before unleashing it on us normies.

Reply on news.ycombinator.com