Hacker News Reader

Of course it's legal. They have a BAA with Google.

Do people think companies that deal with PHI have to build every service in house...? Run their own data centers? Build their own backhaul connections to their users?

View on HN

You have a copy of the BAA? (or a link?)

Here is Google's information on the subject: https://cloud.google.com/security/compliance/hipaa/ (note that the Google Vision API is listed as a covered service, so it's approved for use under a BAA)

Obviously I don't have a copy of the contract between Google and Oscar, but I think it's profoundly unlikely that they would write a blog post about something that would be the end of their company without the "simple" (and industry standard) step of signing a BAA with a vendor.

"Google Cloud Platform was built under the guidance of a more than 700 person security engineering team, which is larger than most on-premises security teams."

That's...encouraging.

Reply on news.ycombinator.com