Hacker News Reader

Excellent. Two of my clients need exactly this service. We have the pain point you describe, i.e. needing to build out AWS, Rackspace, etc. Currently we build custom AWS images, however we'd much rather pay for a HIPAA stack. Kudos!

Many thanks! Appreciate the kind words.

We offer a 30-day free trial, so you can play around with our API without entering a credit card. Caveat -- don’t send us any real PHI until we sign a BAA.

Please feel free to test it out, and if you have any questions shoot me an email. trey@truevault.com

We get to see a wide variety of use cases, happy to share our experiences.

So are you going to sign Business Associate Agreements with your customers? They won't be HIPAA compliant otherwise, under the latest HITECH rules. That's where the analogy to PCI breaks down.

Yes, TrueVault is signing Business Associate Agreements (BAAs) with our customers.

TrueVault is also the first to cover customers under a comprehensive Privacy/Data Breach Insurance policy. As a result, TrueVault is able to indemnify our customers for, from, and against regulatory fines and the cost of breach remediation.

This is how I read this: HIPAA data backend as a service. Can also connect to Stripe for PHI and credit card storage. Most companies are not HIPAA. HIPAA API. Other companies are not HIPAA. We handle HIPAA. We know HIPAA. HIPAA (AWS, FireHost, Rackspace) is not enough. HIPAA. HIPAA! Visit truevault dot com: recent blog entries- Do I Need To Be HIPPA Compliant?

Pretty close.

Stripe is really just used for comparison purposes. Using Stripe makes you PCI compliant, and using TrueVault makes you HIPAA compliant. Also it demonstrates that TrueVault is not a consumer facing document storage solution (not a HIPAA compliant Dropbox). You access data in TrueVault via our API and native clients.

Bottom line, if your application needs to be HIPAA compliant it’s a pain. If you push your protected health information (PHI) to TrueVault, then you don’t have to spend months and months developing your own HIPAA compliant infrastructure.

What's a use case for this?

My client's use case: we have multiple hospitals that need to share confidential information, for example a patient intake survey that is essentially a typical web form. We need somewhere to store that data.

Building the AWS site to do this took upwards of 1000 person-hours to figuring out HIPAA-compliance issues. This will continue to be an ongoing cost for us, because HIPAA is an ongoing law and it changes sometimes. It takes substantial auditing time and money.

TrueVault would save us all that.

That’s a great example. Thank you!

Another use case: apps/sites/devices that offer tools to help people track various health-related statistics.

Consumer-originated data, even though it is health data, is not protected health information (PHI) as covered by HIPAA. But, when that health data is shared with a Covered Entity (a doctor, hospital, insurance plan, or other HIPAA-defined CE) then it becomes PHI. And, the app handling the PHI needs to be HIPAA compliant.

People want information, not data. When an app takes health data and feeds it up to a doctor for diagnosis, analysis, advice, or treatment, then that data becomes PHI and your app needs to be HIPAA compliant.

You said that TrueVault will "handle HIPAA" and that "using TrueVault makes you HIPAA compliant."

I don't see how those claims are true. If the developer is a business associate, they're still required to have a risk analysis, policies, and training. If they're not a business associate, they don't need to be compliant.

So I guess I'm not seeing how TrueVault helps a developer avoid becoming a business associate. jph's case is marginal - if the covered entities all sign BAAs with TrueVault, maybe the developer can argue that they do not "create, receive, maintain, or transmit" PHI. Good luck arguing that with the covered entity, btw.

The steps you will need to take to comply with HIPAA when using TrueVault will vary based on your implementation.

If you use our JavaScript widgets so that you never actually touch PHI, then you may be able to avoid the Administrative Safeguards. But, if you handle PHI and then send it to TrueVault you will need to comply with the Administrative components of HIPAA.

The HIPAA Security Rule requires appropriate Administrative, Physical, and Technical Safeguards to ensure the confidentiality, integrity, and security of electronic protected health information.

HIPAA compliant hosting handles the Physical Safeguards, a set of rules and guidelines that focus on the physical access to protected health information (PHI).

TrueVault handles both the Physical and Technical Safeguards (Encryption and Decryption, Key Management, Key Rotation, Access Control, Unique User Identification, Emergency Access, Automatic Logoff, Audit Controls, Mechanism to Authenticate Electronic PHI, Person or Entity Authentication, Transmission Security, and Integrity Controls). This is all stuff that you would have to build yourself if you use AWS, FireHost, or Rackspace.

You’re right; Administrative Safeguards should not be ignored. The administrative components are really important when implementing a HIPAA compliance program; you are required to assign a Privacy Officer, complete a risk assessment, implement employee training, review policies and procedures, and execute Business Associate Agreements (BAAs) with partners you share protected health information (PHI) with. I think that Accountable does a great job with the Administrative Safeguards. Accountable offers HIPAA compliance management tools that keep your business legal. Checkout -- http://www.accountablehq.com/

So a developer who uses your JavaScript is no longer a business associate?

Again, the steps you will need to take to comply with HIPAA when using TrueVault will vary based on your implementation. I’m happy to jump on the phone and answer any questions that you may have. We can go over the use case that you have in mind and the HIPAA implications. Feel free to email me directly at trey@truevault.com.

To clarify, a Business Associate is any entity that uses or discloses PHI on behalf of a Covered Entity. Furthermore, a Business Associate is any person who, on behalf of a Covered Entity, performs (or assists in the performance of) a function or activity involving the use or disclosure of PHI.

I'm not confused about what a business associate is. I'm confused as to how you can say:

"[TrueVault] gives developers the freedom to create applications that require regulatory compliance without worrying about regulatory compliance."

I'm just asking for one example where that is true, and where a sophisticated covered entity agrees.

LOVE. Thank you. Might sign up soon.

Thank you! That's very nice to hear. Let me know if you have any questions. Here to help. trey@truevault.com