Hacker News Reader

Comment by christiangenco | Hacker News Reader

I can't quite figure out why a HIPAA compliant data storage service is a big deal...

Isn't this just a thin encryption layer on top of Mongo? I feel like I could replicate this in ~100 lines of Node.

There's legal red tape that can matter, for one thing. Any third party you use for this sort of thing potentially needs to sign a Business Associates Agreement with you that ties them in responsibility to your commitment to HIPAA compliance with your users... So there's at least some value to add in being willing to take on that level of legal responsibility.

There's also some value in a service run by folks who know the ins-and-outs and can help abstract or educate users. I meet lots of folks who want to write apps for healthcare but are terrified to wade into the murky regulatory waters. I've no experience with this particular service, but I do think there's room for vendors like this.

[background: developer in healthcare for 10+ years]

The service itself is not a big deal. The contracts that they're willing to sign are a very big deal. I've never had to do it before but my understanding is that getting vendors to sign those BAA contracts and get the indemnity insurance they offer is not trivial.

I don't think it's a big deal necessarily. First, "HIPAA Compliant" is mostly a marketing term as there is no certification, like for things like PCI. The main point of HIPAA is having policies in place that help prevent the unauthorized disclosure of PHI and track/trace authorized disclosure for auditing purposes. To make these policies effective you often need a BAA signed with vendors that can receive/store PHI, and many/most SaaS/PaaS companies are unable to do this.

More details: http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2003.h...

Hint: As with PCI compliance (for credit card data), the hard thing with HIPAA compliance isn't the code but all the non-technical stuff. Legal stuff with regulations, validations, insurance, audits...

It's a few more lines of code more complicated that that :)

In all seriousness, we can give a talk on software security, encryption algorithms and network security with the setup we've created. To do it right, every system in our platform is segregated where one system doesn't see another -through software and network level security. Plus every piece of data is uniquely encrypted with rotating keys (that's kept isolated from the encrypted data). The level of security is like the Secret Service vs. Paul Blart the mall cop.

We are in the middle of writing a blog post about how we harden our platform. Stay tuned.

Noted. I'll be looking out for it!

Reply on news.ycombinator.com