Hacker News Reader

Comment by aik | Hacker News Reader

Wow, cool idea. Though $3,499/month is WAY above what a small company like mine can afford. We're considering paying a one-time cost of ~$10,000 for a consultation to get us there and won't have to do another one for (hopefully) quite a while.

What size/type of company is the target market?

View on HN

Great question! Our customers think of it in terms of how many employees they'd have to hire to get the same functionality. They say we replace at least one engineer and at least one compliance manager. So $42k/yr for that is a good deal, according to them. We are adding a customer page soon so you can meet the companies using Aptible and hear how they made those decisions.

The other thing I'll add is that there are no hidden costs and no gotcha fees. A Prod account gets you all of the help, training, and extra time from us you need to be successful. We don't consult and we never bill for our time.

Thanks for the response. What I wonder then is when does a startup reach a point of hiring a dedicated compliance officer (so that argument becomes relevant)? Now we split the work and pull in 3rd parties as needed. Even for medical or health technology I wouldn't expect it would be in the first 10 employees or first few years of most bootstrapped (and cash-strapped) companies.

That being said, I understand HIPAA compliance (or what it implies) is VERY important and shouldn't be taken lightly...

I'm curious to this as well. One project I'm working on is software that helps small assisted living facilities (think a house in a neighborhood with under 16 residents) maintain compliance with their state regulations. That price point puts them way outside of my budget. EHRs for nursing homes and hospitals? I might have missed it, but a detailed explanation of why their service is necessary would help convince that I need them, or at least who their target market is. Otherwise, I really like the idea.

> Though $3,499/month is WAY above what a small company like mine can afford.

In order to host a HIPAA-compliant application on Amazon, there is a $1,500/month per-zone fee. This does not even count the actual server or storage costs, let alone the costs of building (and then maintaining) a complaint server application plus managing the documentation for it.

You also have to pay this fee again if you want to host the application in a second region (e.g. for failover/redundancy).

So, an extra $2000/month to forget about all of those is a signficant cost, but still a reasonable price.

We have a HIPAA compliant dedicated server with another company, and including bandwidth for 100,000+ / month visits, it is around $1500. We could easily host another website (e.g. Complaint server) on the server with extremely little additional cost.

Hi, very curious here: where did you get this from : "In order to host a HIPAA-compliant application on Amazon, there is a $1,500/month per-zone fee. "........As far as I understand, HIPAA compliant means that data has to be encrypted in transit and at rest ......so, for example, running a SQL Database on an EC2 with SSL and an encrypted file system should do the job and that doesn't cost 1500 per month ??

In order to get a BAA with Amazon you need to use dedicated instances. BAAs are required in order to use Amazon and be compliant with HIPAA. Running any dedicated instances in a zone costs $2/hr (just for the right).

but once you have the BAA , does Amazon force you to run the dedicated instance 24/7 ? I'm very confused , just running an app on a dedicated instance, does not make it HIPAA compliant since the app needs encryption in-transit and at-rest to be HIPAA compliant. You can achieve that on a regular instance ...

The BAA only applies to the dedicated instances—in particular, you have to VPC them—you cannot achieve HIPAA compliance with a non-dedicated instance.

Reply on news.ycombinator.com