Hacker News Reader

> Your doctor or hospital hosts data in AWS? Pretty sure HIPAA doesn't count in this case.

False. I work for a company in the education space that uses AWS. We're unambiguously bound by FERPA. It is inconceivable to me that a stricter law like HIPAA wouldn't also bind cloud-based companies.

EDIT: Moreover: https://aws.amazon.com/compliance/hipaa-compliance/

View on HN

HIPAA is actually pretty terrible in terms of protecting your privacy from government agencies (or from insurers). It can require covered entities (health care providers, plans, or clearinghouses and buisness associates) to hand over medical information to law enforment officials without patient consent, and can even ban covered entiities from informing patients about disclosures under some cirumstances.

The EFF has a lot more detail here: https://www.eff.org/issues/medical-privacy and more specifically: https://www.eff.org/issues/law-enforcement-access

> False. I work for a company in the education space that uses AWS. We're unambiguously bound by FERPA. It is inconceivable to me that a stricter law like HIPAA wouldn't also bind cloud-based companies.

I think the GP was asserting that the NSA doesn't care about HIPAA, not asserting something about HIPAA and Amazon & companies using AWS.

Yeah, after the shadow-edit. The rest of the paragraph I quoted wasn't there originally.

Reply on news.ycombinator.com