How tied are you to the name, it's almost Nambla.
That's all I see when I see this company's name. Unfortunate choice.
Show HN: Using GPT-3 and Whisper to save doctors’ time
111–120 of 141 posts
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#112Earlier quoted context omitted.
From their main page ( https://www.nabla.com/ ), the mention HIPAA: Secure and HIPAA-eligible Audio, transcripts, and notes are not stored by Nabla HIPAA-eligible and GDPR compliant SOC 2 and ISO 27001 certifications in progress Digging deeper ( https://www.nabla.com/blog/privacy-security/ ): This data processing is done on Nabla's servers, which are powered by the HIPAA and GDPR compliant Google Cloud Platform (GCP)…
What does "HIPAA-eligible" mean? EDIT: I was very curious about this and did a bit of research. The answer to it is squishy. It seems to be mostly a marketing term. The best definition I found was this: "A service that is HIPAA eligible is one that is capable of being configured in a way that could meet HIPAA compliance requirements, but you have to know how to do it, it doesn’t happen ‘out of the box.’" https://www.…
lmao literally a weasel word
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#113Earlier quoted context omitted.
Perhaps avoiding commenting on patient privacy concerns may be a better answer than any evasive answer may ever be. Their website's privacy policy doesn't say anything about their product. It's also incorrect (they seem to have switched tracking providers without updating their privacy policy). I would quote the sections that are incorrect, but their terms and conditions forbid copying any content from their site. Th…
Thanks for looking into our legal documents. The ones related to the Nabla Copilot product are different from the website T&C and privacy policy, and can be found here: https://www.nabla.com/legal-documents/ Our product is GDPR compliant.
I read the French legal documents and your notices regarding GDPR.
What I don't understand from those, and statements made by your team in this thread, is how some claims can be compatible.
- That the product is GDPR compliant.
- That you don't store the PII or health data.
- Yet all data is stored at Google servers.
- Also, you reserve the right to re-use said data. (Which, since this is for R&D purposes, should probably qualify you for the need to ask the CNIL for an authorization as "health data repository"? [0])
- That none of the data is sent outside the EU or to additional 3rd parties.
- Yet it uses a fine-tuned "GPT-3" (a term that to the best of my knowledge exclusively refers to Microsoft/OpenAI's US-based API service, not to on-prem GPT-like LLMs like GPT-J or GPT-NeoX).
All in all, I can feel the enthusiasm but it does feel like this thread would have been so much more reassuring with some proactive comments about the privacy/health data issues, rather than have everyone voice the obvious concern with no prepared answers.
[0] https://www.cnil.fr/fr/la-cnil-adopte-un-referentiel-sur-les...
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#114Pretext: My wife is a psychiatrist. Via her, I'm am close friends with many doctors. Also, I know it's super easy to be critical, but I'm going to save you an insane amount of effort and heartache.
This is actually a solved problem in medicine, already. Maybe not solved, but absolutely "good enough". M-Modal, Dragon, and Telephone services (yes, call someone and have them translate) all exist. They all translate notes well enough. For most doctors, it's a huge improvement over typing.
The problem is primarily access. Most institutions simply do not want to pay for this. They don't view it as necessary. Further complicating the issue. Unless a physician is in private practice, they have little to no control over their ability to use a tool like this. HIPAA is far too high of a barrier.
You're trying to implement a technical solution to what's ultimately a politics/human problem.
----
I've spent a bunch of time in the space, both as a MedSpouse and the CTO of a HealthTech company. I wish you the best of luck as I'd love to see life be easier for my wife, but this is _extremely_ far from being MVP viable.
* HIPAA - You absolutely, 100%, without a doubt need to be HIPAA compliant. You likely want to be HITRUST compliant as well. You're very, very clearly a Business Associate (HIPAA term) and processing PHI. Without that, you're dead in the water.
* Chrome extension - This is not going to cut it. At baseline, it requires copy and pasting between Chrome and the EHR system. Bad UX.
* More tactically, most EHR access occurs via remote access, like Citrix. Often from a thin-terminal on the hospital floor or at a med station. These are locked down environments that have a high likely hood of not having Chrome installed _and_ not being allow to install _any_ software (including Chrome extensions).
* Accuracy is important. Accuracy is even more important with _extremely_ similar and _extremely_ uncommon words. For example, can this system differential between prednisone and prednilisone? In fact, can it even identify those words? Can it do it with an accent?
* FHIR is only as much of a standard as tables are to relational databases. The hard part is the thousands of custom fields that are different between health systems.
* Structured data really isn't used or useful in medicine. You might have a medication list that can be structured as data, but actual notes include a lot of prose. I believe part of this is necessary to capture the nuance/minutiae of some healthcare. Part of it stems from the lack of any standard.
* Again, this is all possible already. Tele-notes have been done since the introduction of EHR systems.
* Nobody is going to use a Chrome extension.
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#115Earlier quoted context omitted.
From their main page ( https://www.nabla.com/ ), the mention HIPAA: Secure and HIPAA-eligible Audio, transcripts, and notes are not stored by Nabla HIPAA-eligible and GDPR compliant SOC 2 and ISO 27001 certifications in progress Digging deeper ( https://www.nabla.com/blog/privacy-security/ ): This data processing is done on Nabla's servers, which are powered by the HIPAA and GDPR compliant Google Cloud Platform (GCP)…
What does "HIPAA-eligible" mean? EDIT: I was very curious about this and did a bit of research. The answer to it is squishy. It seems to be mostly a marketing term. The best definition I found was this: "A service that is HIPAA eligible is one that is capable of being configured in a way that could meet HIPAA compliance requirements, but you have to know how to do it, it doesn’t happen ‘out of the box.’" https://www.…
"HIPAA-eligible" means they have no idea what they're doing in healthcare.
The second you said that in a pitch to executive leadership, they'd realize you have no idea how to operate in healthcare.
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#116I feel uncomfortable knowing doctor would use anything like this. How are 2 party consent states handled? Is this HIPPA compliant?
HIPAA only applies to healthcare providers I think. Private companies like the extension maker can do whatever they want. At least that’s what someone on the internet told me and maybe it’s wrong.
Your statement is correct, but not complete.
When a covered entity (a HIPAA-required provider) does business with a private non-covered entity _and_ that transaction involves HIPAA controlled information, they must enter into a Business Associate Agreement (BAA). This effectively forces the private entity to maintain the same HIPAA standard as the provider.
A private company is absolutely free to build non-HIPAA compliant software, but they completely unlikely to get any healthcare providers to actually use it.
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#117Earlier quoted context omitted.
HIPAA only applies to healthcare providers I think. Private companies like the extension maker can do whatever they want. At least that’s what someone on the internet told me and maybe it’s wrong.
No. HIPPA applies to software as the software company would be considered a business associate. "If you handle, store or transmit protected health information (PHI) to or from a covered entity then you need to be HIPAA compliant." Source: https://github.com/truevault/hipaa-compliance-developers-gui...
Business associate only comes into play when you're working with a covered entity. And, covered entities are far less inclusive than most people think.
----
The posted software is absolutely free to be non-HIPAA compliant. They're not a covered entity and without a relationship with a covered entity, they're not a business associate. However, without a relationship with a covered entity, they're also unlikely to generate any meaningful revenue.
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#118Technically interesting but solving the wrong problem. Doctor's already today spent too little time with their patients to understand diseases holistically enough. Adding technically between these 2 will make treatments in most of the cases worse, not better.
> solving the wrong problem You seem quite confident about this, but based on the doctors I know writing notes is a real pain and mostly seen as (important) scutwork. They're only given a set amount of time to see a patient (including notes), and if you can reduce notes they'd actually get more time talking and seeing the patient.
You're both correct. My wife is a psychiatrist. I'm friends with several doctors through her.
Everyone hates notes. However, there are already a bunch of dictation services that help write notes more efficiently. They absolutely work well enough.
Adoption and funding is the primary blocker. When my wife works at facilities that have M-Modal, she's 80%+ faster. However, she works at many, who despite knowing the benefits, simply don't care to spend the time, money, or resources on implementing scribe/dictation services.
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#119Earlier quoted context omitted.
If my doctor is googling he is doing his job. He has medical knowledge which allows him to sort through information. Any developer who doesn't google today is hindering his ability to develop and slowing the development process. Just like the dev cannot hold all the algorithms and language caveats/syntax in his head, a physician cannot hold all the information in his brain. He may not be familiar with symptoms or mig…
I would find it suspect if my specialist was googling unless I had something really weird going on, and might consider going to a different specialist.
I still routinely Google some things that "I should know" when doing software development. Despite being already correct 99% of the time, an internet search helps with two things:
* Presenting potentially new information or methods of doing something. My "old" knowledge might still be correct, but a "new" method may have optimizations or benefits.
* Even though, I'm already 99% correct, it's not worth the hassle of being wrong the 1% of the time - especially when the solution is 20 seconds of internet search.
Re: Show HN: Using GPT-3 and Whisper to save doctors’ time
#120Earlier quoted context omitted.
Off prem is also a rats nest of regulations.
Yes, but it's done once, on demand for each customer and service-wide certificates don't expire for a few years or releases, so the cost is lower.
Yep, I worked at a med-tech company and one of our biggest-value adds was that we were HIPAA compliant and part of Direct Trust — 10k customers one certification.