Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kate's App

katesapp.org

Post reply on HN
Print view View original

181–190 of 192 posts

Re: Show HN: Kate's App

#181

Post by hiatus »

parsimo2010 wrote: post #140
hiatus wrote: post #131

Earlier quoted context omitted.

To my knowledge, HIPAA applies only to entities that accept health insurance or provide services to those entities under a BAA. There have been FTC cases against companies disclosing PHI in breaches but they don't seem to be brought under any HIPAA violation but consumer protection statutes. From your link: > The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care…

HIPAA applies to covered entities, and this app may not be considered a covered entity (the closest they come is a clearinghouse and they probably do not fit the definition), but HIPAA has rules concerning how covered entities deal with business associates. Kate's App would almost certainly fall under the definition of a business associate, and no health care provider should be entering protected information into the…

> To fix the situation, Kate's App needs to certify that their app is compliant and provide an official agreement for providers. Otherwise healthcare providers should stay away, and this app would only be useful for friends and family members.

The OP mentions this is for family members and specifically excludes medical providers from the intended audience.

> This is not a clinic portal, and is not associated with any insurance or medical providers.

It seems the target audience is multiple family members involved in coordinating a loved one's care.

Re: Show HN: Kate's App

#182

Post by jxaphx »

IANAL and this advice is only applicable to US/HIPAA rules based on my experience building and consulting in this space.

HIPAA rules apply to covered entities, and the developer of this app does not appear to be a covered entity. If a covered entity used this service, THEY would be required to enter into a Business Associate Agreement (BAA) with the developer, at which point the developer is on the hook and HIPAA applies.

If a covered entity engages with a platform like this, without a BAA, the liability under HIPAA is borne by the Covered Entity whom the rules apply to.

That said - if you want to engage with covered entities (and I think that should be a goal) you'll need to have all your ducks in a row before they'll be interested. It's all doable though, dont let the gatekeepers push you out.

One thing I've got my eye on right now is Palantir's HealthStart initiative that seeks to streamline the compliance requirements needed to operate in this space legally. Might be worth following if you plan to take this anywhere beyond a hobby.

Last note - my statement here is only about HIPAA. There are any number of state and federal level privacy rules where liability may or may not come into play here. Have a privacy policy, follow it, protect other people's data.If you're not confident you know how to do that, find someone who is. We do have a responsibility to our users that goes well beyond our desire to learn and experiment.

Good luck!

Re: Show HN: Kate's App

#183

Post by securingsincity »

bhpreece wrote: post #168
hk1337 wrote: post #141

I wouldn't worry too much about what a lot of the comments are saying. I would heed some of the advice about being secure but I wouldn't worry too much about it being a problem or shutting down the app until you have it worked out. I don't want to discourage you because it's always good to have multiple options but I would look at what Cariloop ( https://cariloop.com ) is doing, try and focus it like that but with un…

It looks like Cariloop advises people on how to find medical assistance, is that correct? Is there someplace to get more specific information?

Very cool to see Cariloop mentioned here in this conversation. I'm the VP of Engineering at Cariloop. We offer Caregiver support and coaching through our coaches who are nurses and social workers. So one thing they can do is find help for services but they can do a lot in navigating a difficult caregiver situation.

Additionally, we do offer medication tracking and other digital caregiving tools. I will also mention like others here, it is important to have things like HIPAA best practices in place for services like this. At Cariloop for example we follow HIPAA best practices, GDPR compliance, and are SOC 2 certified.

Re: Show HN: Kate's App

#184

Post by bhpreece »

securingsincity wrote: post #183
bhpreece wrote: post #168

Earlier quoted context omitted.

It looks like Cariloop advises people on how to find medical assistance, is that correct? Is there someplace to get more specific information?

Very cool to see Cariloop mentioned here in this conversation. I'm the VP of Engineering at Cariloop. We offer Caregiver support and coaching through our coaches who are nurses and social workers. So one thing they can do is find help for services but they can do a lot in navigating a difficult caregiver situation. Additionally, we do offer medication tracking and other digital caregiving tools. I will also mention l…

Thank you. I appreciate you taking the time to clarify.

Re: Show HN: Kate's App

#185

Post by bhpreece »

jxaphx wrote: post #182

IANAL and this advice is only applicable to US/HIPAA rules based on my experience building and consulting in this space. HIPAA rules apply to covered entities, and the developer of this app does not appear to be a covered entity. If a covered entity used this service, THEY would be required to enter into a Business Associate Agreement (BAA) with the developer, at which point the developer is on the hook and HIPAA app…

I wasn't aware of HealthStart. Thank you for point it out.

Re: Show HN: Kate's App

#186

Post by gooosle »

mdaniel wrote: post #144
gooosle wrote: post #139

Earlier quoted context omitted.

What's wrong with that?

https://portswigger.net/web-security/access-control/idor It's not, by itself, deadly but it does lower the safeguards against ACL slip-ups, which could easily exfiltrate the entire customer base

What safeguards? Obfuscating your IDs by... replacing them with one-to-one mapped other IDs?

Re: Show HN: Kate's App

#187

Post by rabidonrails »

Bjartr wrote: post #174
rabidonrails wrote: post #162

Earlier quoted context omitted.

Maybe fear mongering is overstating but... Speaking to a lawyer is not the first step when building something in this domain (unless you already have someone bankrolling you). In this case there's an app that this guy built for families to use. It's obviously in it's infancy. The helpful advice here would be about posting that this is in beta or maybe reading the HIPAA guidelines and ensuring that he's adhering to th…

Talking to a lawyer is not "stopping everything", it's an hour or two of time and maybe a couple hundred dollars. Not nothing, sure, but not something that should be an obstacle for most here.

At the end of the day I don't think we're arguing here and I'm not saying that the OP _shouldn't_ speak to a lawyer but here are a few choice comments from this post that I'll use to prove my point:

First - the TOP comment in this post: >>" I would advise you to temporarily close your site and hire a lawyer straight away."

And other top level comments: >> You should asap bring the app down, contact all users, send them their info, delete them from your servers, notifying them of that and get a lawyer specialising in health related law.

>>If you can’t answer that question you really need to listen to the people telling you to take it down until you can work it out.

>>Speaking as someone who works in IT in healthcare - you need to close your site down immediately, do not pass Go, etc., and hire a lawyer.

Re: Show HN: Kate's App

#190

Post by mdaniel »

gooosle wrote: post #186
mdaniel wrote: post #144

Earlier quoted context omitted.

https://portswigger.net/web-security/access-control/idor It's not, by itself, deadly but it does lower the safeguards against ACL slip-ups, which could easily exfiltrate the entire customer base

What safeguards? Obfuscating your IDs by... replacing them with one-to-one mapped other IDs?

I believe one can readily agree that https://example.com/profiles/gooosle and https://example.com/profiles/mdaniel are not sequential and thus not subject to enumeration in any reasonable way. A concrete example of defense against this is: please link to the HN username of an account which has never posted

The other very common pattern is https://example.com/profiles/852c1a9a-29ae-4638-9d82-50e0d40... or its b36 encoding which are shitty for reading over the phone but otherwise definitely safe from enumeration

Post reply on HN