Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kate's App

katesapp.org

Post reply on HN
Print view View original

121–130 of 192 posts

Re: Show HN: Kate's App

#121

Post by jeroenhd »

sotomski wrote: post #64
bhpreece wrote: post #36

Thank you everybody for your comments. Comments on legal issues: I absolutely agree and 100% plan to get legal advice. In the meantime, if you have personal experience, I would love to learn from you. Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and…

Hey mate, it just so happens that I’m working on a very similar thing. Maybe I could help you out regarding security and local-first stuff? Drop me an email if you’re interested. Cheers. EDIT: In any case, you could take a look at https://github.com/YousefED/Matrix-CRDT . Matrix takes care of e2ee. CRDTs give you local-first super powers.

Using Matrix+CRDTs for this is a pretty cool idea! It'd take a rewrite of this app, but you could let arbitrary Matrix chat server host the entire data store, getting rid of a lot of the data security risks (as long as you make sure your e2ee approach isn't too eager to share keys).

Then again, doing things this way might make data deletion and other privacy related issues quite difficult to achieve, especially if said Matrix servers are federated.

Re: Show HN: Kate's App

#122

Post by dailydetour123 »

I like the principle of making information easier to share and more accessible for those who need it. However, from the perspective of someone who uses WhatsApp a lot, I think a decent chunk of this info could be shared in a WhatsApp group that includes relevant stakeholders - assuming there is a way to include the medical professional’s input. I would imagine in Europe that is how people might already be solving this problem. I think additionally it is generally an uphill battle to get people to adopt and incorporate another messaging/comms platform into their day-to-day life. It doesn’t mean it’s not important or right what you’ve built, just that in my experience people resist (and ultimately don’t use) additional platforms for messaging/sharing info outside the ones they might already have.

Re: Show HN: Kate's App

#123

Post by dmd »

Speaking as someone who works in IT in healthcare - you need to close your site down immediately, do not pass Go, etc., and hire a lawyer. You are opening yourself up to practically unlimited liability.

Re: Show HN: Kate's App

#124

Post by imglorp »

otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

This is a frustrating conversation.

It appears that anonymized data medical data are being sold en masse by providers (*) because money. But it's also obvious to us tech folk how trivial it is to combine anonymized patient encounters with location and credit card purchase data etc to de-anonymize it and resell as enriched.

So the only people who are effectively bound by HIPAA are the well-intentioned ones who have to protect themselves and and comply; the rest are laughing at them on the way to the bank.

* https://www.theverge.com/2021/6/23/22547397/medical-records-...

* https://www.scientificamerican.com/article/how-data-brokers-...

* https://www.medicaleconomics.com/view/who-profits-our-medica...

Re: Show HN: Kate's App

#125

Post by netdevphoenix »

skrebbel wrote: post #114
fnimick wrote: post #113

Earlier quoted context omitted.

Damages? The potential payout is enormous.

Yeah but, how can there be damages without a breach?

Kate is a citizen. She is 60 years old and the family lives away. She gets visited daily by a care worker. Kate downloads the app and enters her data. Kate shares her data with the care worker so it can be managed for things like appointments and medication. The manager of the care worker sees the app, checks that the site has no policy whatsoever. Shares the name of the app with the law department. Law department contacts the local health authority regarding the app legality. The local health authority begins proceedings against the developer. Developer loses money

Re: Show HN: Kate's App

#126

Post by JoeAltmaier »

netdevphoenix wrote: post #125
skrebbel wrote: post #114

Earlier quoted context omitted.

Yeah but, how can there be damages without a breach?

Kate is a citizen. She is 60 years old and the family lives away. She gets visited daily by a care worker. Kate downloads the app and enters her data. Kate shares her data with the care worker so it can be managed for things like appointments and medication. The manager of the care worker sees the app, checks that the site has no policy whatsoever. Shares the name of the app with the law department. Law department co…

That makes sense, and I hope it would work. Still, that's maybe an old view of how software and business work. In truth the app is a whipped-together thing, and the 'company' selling it is a shell. The address is a blind PO box.

Law department visits the box and finds nobody. Shell company changes name (indeed, perhaps they have a different name for every victim) and resume operation immediately. Hell, they never stop selling for a millisecond.

Follow the money? Ha. The modern ideas of currency make such schemes bulletproof.

Re: Show HN: Kate's App

#128

Post by PittleyDunkin »

imglorp wrote: post #124
otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

This is a frustrating conversation. It appears that anonymized data medical data are being sold en masse by providers (*) because money. But it's also obvious to us tech folk how trivial it is to combine anonymized patient encounters with location and credit card purchase data etc to de-anonymize it and resell as enriched. So the only people who are effectively bound by HIPAA are the well-intentioned ones who have to…

> the rest are laughing at them on the way to the bank.

My understanding is that HIPAA is intended to stop providers from colluding against the patient, not to stop providers or middlemen from enriching themselves with our data.

Re: Show HN: Kate's App

#129

Post by netdevphoenix »

JoeAltmaier wrote: post #126
netdevphoenix wrote: post #125

Earlier quoted context omitted.

Kate is a citizen. She is 60 years old and the family lives away. She gets visited daily by a care worker. Kate downloads the app and enters her data. Kate shares her data with the care worker so it can be managed for things like appointments and medication. The manager of the care worker sees the app, checks that the site has no policy whatsoever. Shares the name of the app with the law department. Law department co…

That makes sense, and I hope it would work. Still, that's maybe an old view of how software and business work. In truth the app is a whipped-together thing, and the 'company' selling it is a shell. The address is a blind PO box. Law department visits the box and finds nobody. Shell company changes name (indeed, perhaps they have a different name for every victim) and resume operation immediately. Hell, they never sto…

Domain ownership, cloud accounts, IP addresses. All of these can be used to as a collection of evidence to pinpoint the target. In the old days, it would be harder but nowadays everyone is sheds fingerprint cells the same way leave dead cells with our DNA everywhere

Re: Show HN: Kate's App

#130

Post by jillesvangurp »

otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

This is good advice.

Beyond HIPAA and similar regulations, there's the broader challenge that part of the intended audience probably would not want to use it for the same reasons. Any health care professionals that handle information like this are subject to the same rules and would only use tools that comply to minimize liability.

And there's the related problem of those people probably already having a lot of tools that they use and prefer. Another tool adds to their work load.

But I don't want to completely discourage you. If you are serious about turning this into a business, I'd look into how to connect to other tools. Maybe add some IOT integrations to the mix, etc. Most GPs would love a good tool like that. Many of the tools in this space are more than a bit crap. The key to success is understanding who experiences the most pain here and taking that a way (which in this context is also a nice metaphor).

Some feedback:

- who or what is Kate? Not really clear what this name is about.

- what's the business model here? Who pays for what and why? How is that going to evolve.

- get a designer or level up your own design skills. I'm not one but I can see you didn't use one.

- work on your pitch, it raises a lot of questions. Like how you are storing information, what the pricing is, and how you deal with privacy issues, etc. Vaguely hinting at that being important in a hand wavy way doesn't make it better. Taking topics like that serious requires a more structured approach to address those things. This communicates the opposite of what you probably intend here.

Post reply on HN