Hacker News Reader

Comment by 2mur | Hacker News Reader

I'm a physician. I would love to hear about you implemented HIPAA compliance for both the iOS app and for the web service. I think it is a huge problem for any healthcare startup with potentially serious penalties (even criminal!) for mis-implementation. It is a serious third rail.

View on HN

I'm a physician too. I would definitely be interested in this also. However, having developed a web app in med school, my experience was the HIPAA security rule is pretty weakly specified compared to credit card auditing. PGP is specifically mentioned as a best practice last I read, and plain fax in the same rank of good enough. Seriously, you're relying on an underfunded agency with a distinct lack of crypto expertise for auditing. Compare that to, say, FIPS and other serious requirements that NIST manages.

Meanwhile, I have seen IT departments sell physicians on obviously flawed security products, mainly because few physicians have any idea of what crypto is, let alone could they explain the most basic ideas. And frankly, they are not competent to even hire competent IT people. Whole university systems seem have this problem.

I think the requirements are fairly nebulous at best and mostly aimed at documenting your practices for access, and (god-forbid) breach/compromise. I think that you are covered if you cover these things in you operating procedures, but that is just from my own cursory research.

I'm mostly curious about the web stack and technical implementation:

* Encryption in transit (SSL) and at rest (whole-database encryption versus field-specific encryption)

* Select auditing (and performance thereof)

* Open-source stack?

I'm a pathologist so I'm primarily interested in interfacing with existing LIS (lab info systems). I'd like to pursue efficiency solutions for the laboratory (like dashboards, specimen tracking, lab ordering, intra-lab communication).

Of course, it's all moot with respect to my day-job because I work for the military and they mostly piss on open-source (MS all the way!) with no real path for putting applications on NIPRnet (yes even at the hospitals) without enterprise-level support and multi-level security audit/approval. Which explains why in the age of digital pathology, we are stuck entering pathology information over ssh (terminal emulation) into a MUMPS system.

Here's the combined rules. The security rule starts on page 38.

http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyr...

>they mostly piss on open source

At the top, they guys with stars who sign off the contracts, yes. On the other hand, I was just on the phone yesterday with a Navy cryptographer who is working with Google on NIST certification of Mozilla's Network Security System (NSS) for FIPS 140-2 compliance. I think getting the network changed will ultimately come down to smart people like yourself continuing to beat the drum.

BTW, I'm military too! I know CHCS and AHLTA all too well. email me: niels.olson at gmail

drchrono started working in the medical billing space 2.5 years ago, the surprising thing is that all of this information is already out there. Medical billing condition/procedure codes that are electronically reported by 90% of doctor's offices already disclose all of this information across secure channels to insurance companies and government payers.

drchrono takes security really seriously! The Doctor is our only customer and we always use encryption and security standards to make sure no data is ever compromised and never shared with any 3rd party.

Healthcare information is even more important to keep private than financial information. If you were bankrupt 5 years ago, nobody cares (you could be a millionaire today.) But if you had a serious medical condition 5 years ago, that still affects you for the rest of your life and could be used to unfairly discriminate against a patient.)

In addition to following HIPAA standards, we are in the process of getting certified for Meaningful Use criteria by a 3rd party government certified laboratory for security and encryption standards.

Ding ding ding. That's the elephant in the room, I was surprised the article neglected to mention it.

Ding ding nothin'. Physician fear of the unknown is the elephant in the room. If you know anything about crypto and read the hipaa security rule, it's very underspecified. The Gov't will be the first one to bear culpability if they push too hard on this. That said, no serious data custodian is going to lack for vastly more than adequate tools for data security.

Sorry, still disagree. Software gets into healthcare one of two ways: a.) pre-packaged from big vendors or b.) contracted custom code. It doesn't get in from Apple's App Store, no matter how much we wish it did.

The Gov't will be the first one to bear culpability if they push too hard on this.

Riiight.

Reply on news.ycombinator.com