Show HN: Using GPT-3 and Whisper to save doctors’ time

Hi, I have two questions.

First question - you say that you don't store anything (no audio, no transcript, no note), but your legal agreement says that in order to use this service, the doctor asserts to you that they have gotten consent from the patient for you to reuse all data processed through the service for research and development, and to improve the performance, models, and algorithms of this or any other solution you come up with in the future. Why the difference and how do you square A with B?

"Due to the substantial financial, material and human investments made by NABLA within the framework of the Contract for the development and updating of the Solution, NABLA wish to be allowed to reuse the data processed within the framework of the Contract.

The CLIENT, when applicable in the name and on behalf of the DATA CONTROLLER, warrants that the Data Subjects have been informed of their rights and have given their consent for the use of their data within the framework of the Contract when required by applicable laws or the Regulation and authorizes the DATA PROCESSOR to reuse the Data processed within the framework of the Contract, as long as the latter undertakes to comply with the Regulation for all of this Data, for the uses listed below:

- research and development of the Solution,

- improving the performance, models and algorithms developed and trained by NABLA in the context of the Solution or any other solution published by NABLA,"

Second question - you say that you don't store anything (no audio, no transcript, no note) and that it is all erased at the end of each consultation. But do you store any artifacts derived from the audio, transcript, or notes of a consultation, like data processed directly or indirectly from the audio, transcripts, or notes of a consultation that is fed in to an AI model, ML model, or other dataset that you persist after the consultation?

Ignore the nay-sayers in this thread. I doubt the ones commenting have spent many days personally observing or personally doing the problem scenario you are solving for.

This is spectacular for telemedicine in the post-covid regulation environment.

The new model is an onsite medical assistant taking patient vitals and setting up the Zoom, the patient then talks to an APRN (Advanced Practice Registered Nurse) in the patient's field (e.g. subacute care, gerontology, etc.).

The APRNs spend 30 minutes reading the file, tele-consult with a patient for a half hour. Medicare pays for the half hour. Then the APRN has to spend ~60 minutes turning that session into the EHR notes. Many just don't, they make an ultra short note, and hope Medicare doesn't challenge it. Patient loses. If too strapped for time, they also may not pre-read, because they only get paid for the video conf time. Patient loses.

Downside I see with this is the APRNs doing telemedicine are making about 1/4 of the rate they should be, and can't afford an expensive tool. The telehealth provider is not going to pay for it, they get paid for the 1/2 hour, the wasted time is not out of their pocket, so they won't spend to make it up. This is going to be on the nurse, who likely can't afford it.

On the plus side: time saved with this tool would go directly to ability to pre-read, or ability to see a patient an hour instead of one per two or three hours. It would also permit a higher caliber of expertise nurse to do tele-medicine visits in off days, because the time saved could bring comp back more in line with the expertise.

Go for it!

What that really means is:

* they may be HIPAA-compliant (ie: they fulfill the requirements), * they haven't gone through a HIPAA-certification (no third-party cert), * they aren't using services that aren't HIPAA-certifiable

The latter point is important, because there are some services (ie: firebase) that apparently won't be HIPAA compliant. Some services are HIPAA-compliant if configured correctly. AWS has a list. I believe google does too.

There are a bunch of HIPAA guides out there.

So as a demo, it's not a big deal. But if they start selling this they need at least to be HIPAA-compliant with certification on the roadmap.

Either they are offering to sign a HIPAA BAA or they aren’t. If they aren’t, its HIPAA-radioactive. HIPAA-eligible for this kind of service is meaningless; when you have PHI going through a third party system, its BAA or GTFO.

I trust a scribe because they are a person with years of specialised training and experience who can be held accountable.

> in any case, HIPAA will protect you

It protects you insofar as it disincentives honest actors from doing sketchy things with your data. It's punishment for orgs, not protection for patients, like how laws against murder punishes the murderer rather than protecting the victim.

The best thing a patient can do to protect their privacy is to be actively avoid of medical practitioners that, for example, use tools like this which send your private medical consultation transcripts to God-knows-where.