Hacker News Reader

Hacker News

Comment by Asmod4n | Hacker News Reader

Full thread

Asmod4n

The headline should be: How we handed Google all your medical information and you didn't even know about it.

View on HN

Exactly.

The article is from someone in the Oscar Health Insurance.

According to Wikipedia, the company:

https://en.wikipedia.org/wiki/Oscar_Health

is claiming transparency in claims pricing:

>Oscar Health Insurance is a technology-focused health insurance company founded in 2012 and headquartered in New York City. The company has plans to change the health insurance industry through telemedicine, healthcare focused technological interfaces, and transparent claims pricing systems.

Maybe they extended the transparency to people's health data.

Here is another article (still on Medium) that incidentally talks of the Author (as engineer employed in the company):

https://medium.com/oscar-tech/whats-it-like-to-be-an-enginee...

Is this legal? Did they even read the TOS for Google?

Of course it's legal. They have a BAA with Google.

Do people think companies that deal with PHI have to build every service in house...? Run their own data centers? Build their own backhaul connections to their users?

You have a copy of the BAA? (or a link?)

Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA)

Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.

"Google Cloud Platform was built under the guidance of a more than 700 person security engineering team, which is larger than most on-premises security teams."

That's...encouraging.

With Abbyy and ocr.space Local there are good and (for companies) affordable local OCR solutions available. There is really no need to use online(!) OCR for sensitive data. Plus, local ocr is faster.

I'm sure they have a BAA with Google, which holds Google to the same HIPAA PHI handling requirements.

I am not sure they do. They probably are just using Google Vision API as a regular customer. The pricing will change if Google had to do a legal deal with these folks.

That would immediately trigger a company ending lawsuit. There is zero chance they are using a service for handling PHI without a BAA in place with the vendor of that service.

Defending on the service provider, there may be an upfront cost for signing a BAA, but generally the service costs remain the same (assuming you stick to "BAA approved" services). In the case of Google, there is no additional cost:

"As such, we can offer HIPAA regulated customers the same products at the same pricing that is available to all customers, including sustained use discounts. Other public clouds charge more money for their HIPAA cloud, we do not."

https://cloud.google.com/security/compliance/hipaa/

Evidence? Getting a BAA from Google or Amazon or Microsoft is trivial.

Because that will fit the HN narrative well ?. How about commenting on the Google vision API and it's accuracy as well ?

It’s a HIPPA compliant cloud service. Google is orders of magnitude less scary than your average health insurer.

I've never dealt with HIPPA; what restrictions does it put on internal use? Who, within Google, could they share raw data with? What about "anonymized" data?

See: https://cloud.google.com/security/compliance/hipaa-complianc...

Any reputable cloud service implements technical and process controls to control or eliminate access to customer data. Doing something like incorporating customer data into advertising would be a very serious situation, and frankly I doubt anyone would be that dumb at scale.

Google will contractually agree to a bunch of things relative to this and has third party audits to provide additional assurance.

Reply on news.ycombinator.com