Hacker News Reader

Comment by humanlion87 | Hacker News Reader

This sounds very interesting and I am tempted to sign up. But the biggest worry for me is the privacy of the data. There is a mention on the website that data isn't shared without consent. But that can always change in the future once VCs get involved and they are trying to maximize revenue. Or the business model changes.

View on HN

This is actually not possible. There is a set of laws called the "Health Insurance Portability and Accountability Act" or HIPAA. This prohibits us and anyone else to misuse your data and share them without your consent.

> Many people don’t realize that the Health Insurance Portability and Accountability Act (HIPAA) actually enables information sharing. HIPAA (specifically the HIPAA Privacy Rule) defines the circumstances in which a Covered Entity (CE) may use or disclose an individual’s Protected Health Information (PHI). HIPAA provides many pathways for permissibly exchanging PHI, which are commonly referred to as HIPAA Permitted Uses and Disclosures.

https://www.healthit.gov/topic/interoperability/how-hipaa-su...

Thanks again for raising these points. They’re great feedback, especially in that we want to build a privacy-first company. As our next step, we’ll be taking all of these points to our legal team to update our privacy policy, and we’ll have a data security officer join our team soon.

You are absolutely right. What it comes down to, however, is consent by the individual. Data will not be shared without your permission. We will make sure our legal language is clearer here.

I think what people are getting at is that the legal language can be changed after an acquisition and our previously-safe data is now owned by a less scrupulous entity.

But what data? All of it or some subset? Aggregated, differentially privatised, non-identifiable chunks?

Without specific explanations, you could always weasel out of vague promises.

Sorry to sound negative. I'd love a service like this, but there's a very high bar for responsible implementation (in my opinion) and VC seems very unlikely to be compatible with responsibility.

Basically, what is your business model? Are you only making money from subscriptions, or through other means? What are the VC's expectations?

You went from "this is not possible" to "will not be shared without your permission" in one reply sequence. This whole thread is covered with people noting your website's doublespeak.

I think you need to stop for a bit and think about what ethical behavior is.

It's concerning that you either don't understand HIPAA at all, or you're using it as a smoke screen to not actually address the concerns raised. Neither option is great here...

Reply on news.ycombinator.com