Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kate's App

katesapp.org

Post reply on HN
Print view View original

131–140 of 192 posts

Re: Show HN: Kate's App

#131

Post by hiatus »

otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

To my knowledge, HIPAA applies only to entities that accept health insurance or provide services to those entities under a BAA. There have been FTC cases against companies disclosing PHI in breaches but they don't seem to be brought under any HIPAA violation but consumer protection statutes.

From your link:

> The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the "covered entities")

Re: Show HN: Kate's App

#132

Post by Bjartr »

rabidonrails wrote: post #120

I think the fear-mongering here has spiraled out of control. This app seems to be a place that patients (and their caregivers read:family) can upload and share data amongst themselves. While you might not fall directly under HIPAA laws (as I don't think you a covered entity nor a Business Associate) you definitely are aware that you will have PHI and thus you have to protect it - especially if you're saying that it's…

I don't read others' warnings as fear mongering. Rather, they are genuinely offering concrete steps to be taken to avoid problems that frequently arise in this domain.

"Go talk to a lawyer" is not an attempt to scare or some impossible abstract advice. It's a very concrete, and very reasonable step that really ought to be taken early on in this effort.

Maybe everyone here is off base. How might the app developer determine this? By talking to a lawyer.

Re: Show HN: Kate's App

#134

Post by kmoser »

i_love_retros wrote: post #10

> You data will not be sold, shared, or given away. Your medical data is the most private data you have, and we respect that. So you're hack proof and idiot employee proof?

The claim doesn't say they won't be hacked. The implication is that they won't willingly do those things.

Re: Show HN: Kate's App

#135

Post by 52-6F-62 »

gwbas1c wrote: post #80
diggan wrote: post #37

Earlier quoted context omitted.

How do you know that the authors are novices with "complete blindness" to real consequences? Where are you getting the "find a learning project" goal from? It sucks that you've been burnt by that before, but it sounds like your employer was the one who screwed you there, not the author of the application.

Complete lack of legal compliance in the area that they are operating; the style of the name. The issue of my employer is an example of real world consequences when a novice builds a product without understanding the rules they need to follow. Unfortunately, there is a cohort of people in the startup scene, and who also participate in Hacker News, who don't like to hear negative feedback even when there are very clea…

Should it be called “healthily” or “contactful” instead? Lol

Startup names are so stupid

Re: Show HN: Kate's App

#136

Post by 52-6F-62 »

tantalor wrote: post #57
diggan wrote: post #37

Earlier quoted context omitted.

How do you know that the authors are novices with "complete blindness" to real consequences? Where are you getting the "find a learning project" goal from? It sucks that you've been burnt by that before, but it sounds like your employer was the one who screwed you there, not the author of the application.

They don't know, it's a total guess. That's why they hedge with phrases like "smell" and "if your goal..."

Reminds me of the (so called) engineering teams I’ve worked with at high profile startups who dealt primarily with their software based on “code smell”. It was amazing. If you accomplished something that didn’t make your boss look smarter than you then it was a bad “code smell”. Logic be damned

Re: Show HN: Kate's App

#137

Post by 383toast »

diggan wrote: post #37
gwbas1c wrote: post #16

I don't want to repeat other comments here; but this app smells of a very dangerous attitude: Built with love by novices with grand intentions, with complete blindness to the real consequences that happen when novices are ignorant in their field. If your goal is to "find a learning project," I suggest finding a very different "learning project." Otherwise, keep "Kate's app" private, word-of-mouth, invite-only for und…

How do you know that the authors are novices with "complete blindness" to real consequences? Where are you getting the "find a learning project" goal from? It sucks that you've been burnt by that before, but it sounds like your employer was the one who screwed you there, not the author of the application.

Telltale signs of application immaturity like using ids as urls

https://katesapp.org/patients/41

Re: Show HN: Kate's App

#140

Post by parsimo2010 »

hiatus wrote: post #131
otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

To my knowledge, HIPAA applies only to entities that accept health insurance or provide services to those entities under a BAA. There have been FTC cases against companies disclosing PHI in breaches but they don't seem to be brought under any HIPAA violation but consumer protection statutes. From your link: > The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care…

HIPAA applies to covered entities, and this app may not be considered a covered entity (the closest they come is a clearinghouse and they probably do not fit the definition), but HIPAA has rules concerning how covered entities deal with business associates.

Kate's App would almost certainly fall under the definition of a business associate, and no health care provider should be entering protected information into the app without entering into an official agreement that the data will be protected according to HIPAA rules.

So technically Kate's App isn't doing anything illegal, but any health care provider entering info into this app would be. To fix the situation, Kate's App needs to certify that their app is compliant and provide an official agreement for providers. Otherwise healthcare providers should stay away, and this app would only be useful for friends and family members.

(I am not a lawyer, but I have analyzed health care data and it's cumbersome to deal with, especially if you are transmitting over a network). https://www.hhs.gov/hipaa/for-professionals/covered-entities...

Post reply on HN