Arthur Howell, is this you? https://www.linkedin.com/posts/arthur-howell_im-excited-to-s...
Show HN: Kate's App
161–170 of 192 posts
Re: Show HN: Kate's App
#162I think the fear-mongering here has spiraled out of control. This app seems to be a place that patients (and their caregivers read:family) can upload and share data amongst themselves. While you might not fall directly under HIPAA laws (as I don't think you a covered entity nor a Business Associate) you definitely are aware that you will have PHI and thus you have to protect it - especially if you're saying that it's…
I don't read others' warnings as fear mongering. Rather, they are genuinely offering concrete steps to be taken to avoid problems that frequently arise in this domain. "Go talk to a lawyer" is not an attempt to scare or some impossible abstract advice. It's a very concrete, and very reasonable step that really ought to be taken early on in this effort. Maybe everyone here is off base. How might the app developer dete…
Maybe fear mongering is overstating but...
Speaking to a lawyer is not the first step when building something in this domain (unless you already have someone bankrolling you).
In this case there's an app that this guy built for families to use. It's obviously in it's infancy. The helpful advice here would be about posting that this is in beta or maybe reading the HIPAA guidelines and ensuring that he's adhering to those guidelines where applicable. Focus on tightening up security. What's his plan to ensure that data in encrypted in transit and at rest? What kind of monitoring will the app have? Does he need to be thinking about intrusion detection? Will he need to enforce 2FA?
Does he need to stop everything and start speaking to lawyers? Probably not.
Re: Show HN: Kate's App
#163Earlier quoted context omitted.
This service is currently running, in production, in the United States, and is missing key features that are regulatory or legal requirements. I won't enumerate them because I work in security, not privacy or compliance (although those are features that require strong security and I often support related projects). The app is designed to allow sharing of personally identifiable information, and apparently doesn't dis…
For the record: I don't disagree with anything above. My question was more about whether you need a lawyer to know you need a privacy policy... It was tangential, admittedly; sorry about that. To make the direction of the tangent clearer (and please ignore it if it distracts from the main discussion too much): I'm in the EU, and I know that I'd need to read GDPR[1] before letting people see such an app. I haven't rea…
A side effect of my career is that I have been in compliance adjacent roles for 20 years or so, and as a result I have read most of the related regulations. I still defer to a lawyer for actual opinions, but have frequently had to explain the technical implications of regulations to lawyers.
The bottom line is that the regulation is not a technical specification, it is a legal document, and parsing a legal document requires both the ability to read the regulation, and also to reason by applying the jurisprudence that is specific to the jurisdiction for the regualtion. Essentially, interpreting the law and translating it into requirements requires the ability to both outline the technical requirements and understand what is required to make the implementation legally defensible.
A good example of this is data deletion under GDPR. The expectation of the law is that when you get a deletion request, you will delete the data. In practice, deleting data is hard, unless you build your backup mechanisms to allow deletion of individual fields. With that in mind, companies meet this requirement by implementing a deletion scheme for production systems, and a mechanism such that datasets marked for deletion are logged, and when a restore from backup is performed, the restoration process references those deletion logs to ensure that deleted records are not restored. This, technically speaking, does not result in proper deletion of the data, but it has passed audits under data deletion regulations (Disclaimer: this is based on public documents detailing data deletion requirements, not my work directly. Consult your lawyer, I am not a lawyer, and I am not on your compliance or security team and this is not a recommendation).
Re: Show HN: Kate's App
#164Earlier quoted context omitted.
I would appreciate a recommendation. I'm in Minnesota.
IANAL either but if I were you, I’d start here: https://www.vanta.com/products/hipaa or look for competitors. And perhaps look at Stripe Atlas for getting my corporate ducks in a row to start with. https://stripe.com/atlas Wading into that to get oriented, you would then be better equipped to have at least a baseline. A corporate attorney would be the next step to verify what you’re doing. Minnestar.org hosts network…
Thank you. I'll look into all of this.
Re: Show HN: Kate's App
#165Arthur Howell, is this you? https://www.linkedin.com/posts/arthur-howell_im-excited-to-s...
Arthur Howell is not me, and I have no connection with him.
Re: Show HN: Kate's App
#166Earlier quoted context omitted.
I use MyChart. It's a great way for your doctor and clinic to communicate with you. It's not a place where I'm going to store contact information for all my doctors, or appointments for doctors that aren't at that clinic, or all my prescriptions and all the pharmacies. When your daughter is reacting badly to her new chemotherapy, and running fevers and throwing up, and somebody needs to call her palliative care speci…
Does that work if you have multiple caregivers? Even seeing a doctor, and then getting a scan can involve multiple entities.
Other providers in the same clinic can be on the same MyChart. Different clinics might have different MyCharts. Some clinics don't user MyChart, or have a different app. And as you said, you may have many providers, and they are not all on the same MyChart.
Re: Show HN: Kate's App
#167Could this be used as a community “social network” where seniors or people with disabilities can reach out for specific asks like getting driven to a doctors office or getting a prescription picked up, etc.
I'm sorry, no.
Access to information is strictly limited only to specific individuals who must be explicitly granted access.
Re: Show HN: Kate's App
#168I wouldn't worry too much about what a lot of the comments are saying. I would heed some of the advice about being secure but I wouldn't worry too much about it being a problem or shutting down the app until you have it worked out. I don't want to discourage you because it's always good to have multiple options but I would look at what Cariloop ( https://cariloop.com ) is doing, try and focus it like that but with un…
It looks like Cariloop advises people on how to find medical assistance, is that correct? Is there someplace to get more specific information?
Re: Show HN: Kate's App
#169Does this support FHIR? If not have you considered supporting it? Many health care providers offer export of health records to FHIR format now. You can also retrieve those records on iOS via the HealthKit API. Apple lets you log into your health care provider in the Health app and download all your records from supported providers. You can request access to those records from another app installed on your phone.
I have not thought about into this, but I'll need to look into the possibility. This could be a useful feature for an eventual version. Thanks for the idea.
Re: Show HN: Kate's App
#170If you got to https://katesapp.org/static/What%20Is%20Kate's%20App.html and click the "Kate's App" button at the very top of the page, it takes you to a 404. Just FYI if you want to fix that.
Already noted by another user. Thank you.