Hacker News Reader

Comment by atroyn | Hacker News Reader

What were these records doing on AWS in the first place? AWS isn't HIPAA compliant, surely?

It can be! https://aws.amazon.com/compliance/hipaa-compliance/

While Amazon offers a business associate agreement ("BAA"), our legal review found it to be unacceptable -- the BAA we were privately provided last year significantly deviates from the standard language recommended by the U.S. Department of Health and Human Services [1].

Notably, Rackspace's BAA is public [2] (I'm not associated with Rackspace) and reasonably supports the standard language (I am not a lawyer).

[1] http://www.hhs.gov/ocr/privacy/hipaa/understanding/covereden... [2] http://www.rackspace.com/en-us/information/legal/hipaabaa

Would you happen to remember any issues your team had with Amazon's BAA that they didn't have with Rackspace's?

https://www.prometheusresearch.com/how-amazon-reminded-us-th... (2014)

In particular, Amazon's agreement included: A clause that puts all of the burden for securing data on the CE. No terms outlining how the BA would respond to breaches of unsecured PHI. Lack of specification about the BA’s level of access to PHI. A non-disclosure clause.

EDIT: Google Cache for this page... http://webcache.googleusercontent.com/search?q=cache:tzvzlVG...

AWS offers a BAA with some services

https://aws.amazon.com/compliance/hipaa-compliance/#What_Ser...?

Offering a BAA is necessary, but not sufficient, to be a HIPAA-compliant service.

You'd be surprised (or many not!) of the percentage of healthcare companies which aren't HIPAA compliant.

But that's illegal...

Well, yes and no and yes and no.

HIPAA doesn't actually protect you as much as you'd think--for example everyone who is signed on as a business partner (and similarly HIPAA qualified) can, if memory serves, view records.

They can, but they are similarly bound to have audit records of access, restrict access to only those with a business need to the information, and most importantly, BA's have a duty to notify of a breech. Prior to HITECH it was only the provider who was obligated to notify of a breech—business associates could do pretty much whatever they wanted as far as CMS was concerned, though the data sharing agreements oftentimes had more teeth to them than HIPAA itself.

Yes, "bound." However those things are never really checked.

Seeing as how I'm the guy that used to do the checking, I humbly disagree.

Reply on news.ycombinator.com