Show HN: Kate's App • Hacker News Board

Re: Show HN: Kate's App

#21

Post by jph » Thu, Jan 09, 2025, 6:24 PM UTC

otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

> Whenever you touch this kind of data, regulatory regimes like HIPAA apply,

My understanding is you're an actual attorney, yes?

Can you shed any light on this area...? My understanding is HIPAA and similar laws aren't applied as a result of a user disclosing their own information for their own purposes. For example, you can freely put your own personal medical information into Google Docs, Apple Notes, Facebook post, X tweet, Excel spreadsheet, etc.

I ask because Kate's App is similar in ways to my app BoldContacts, which is helps people care for their parents and disabled loved ones. I strongly believe that these kinds of apps need some kinds of privacy protections that are lighter-weight than HIPAA. I haven't yet found a perfect answer.

https://boldcontacts.org

Re: Show HN: Kate's App

#22

Post by cess11 » Thu, Jan 09, 2025, 6:25 PM UTC

Who is on the board and what experience in the field do they have?

I couldn't find a privacy policy so it's likely to be criminal to supply this software to EU citizens.

Re: Show HN: Kate's App

#23

Post by bhpreece » Thu, Jan 09, 2025, 6:26 PM UTC

hk__2 wrote: post #14

The header link of static pages like https://katesapp.org/static/What%20Is%20Kate's%20App.html doesn’t work.

The page loads fine on all my devices and browsers. What are you seeing?

Re: Show HN: Kate's App

#24

Post by rafram » Thu, Jan 09, 2025, 6:26 PM UTC

maeil wrote: post #18

otterley wrote: post #11

Earlier quoted context omitted.

That's not for any of us to determine here. A lawyer can answer that.

[flagged]

This is literally an app that asks for your confidential medical information. My not-a-lawyer interpretation of the law is that it probably is not covered by HIPAA (to be a "business associate" you need to have a direct financial relationship with a covered entity, i.e., a medical provider), but your snark is pretty reductionist.

Re: Show HN: Kate's App

#25

Post by cess11 » Thu, Jan 09, 2025, 6:27 PM UTC

i_love_retros wrote: post #10

> You data will not be sold, shared, or given away. Your medical data is the most private data you have, and we respect that. So you're hack proof and idiot employee proof?

Apparently, and they'll never enter bankruptcy proceedings and get sold that way.

Re: Show HN: Kate's App

#26

Post by nkozyra » Thu, Jan 09, 2025, 6:28 PM UTC

roegerle wrote: post #9

otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

Are they a covered entity?

While I agree that they probably aren't, their intended customer base is.

And even so, nothing precludes people from pursuing civil damages if there's a data breach - this is far more likely with sensitive data coming from a medical provider to a third party.

And as has been hinted at, the lack of professional presentation is going to hurt a lot, and people will immediately ask "can I trust this platform with any of my information?"

Re: Show HN: Kate's App

#27

Post by motohagiography » Thu, Jan 09, 2025, 6:29 PM UTC

contra view to these comments: keep going. I worked in health information privacy and security longer than all of them and the number of sincere people in it is diminishingly small. the field has become infested with gatekeeper nerds and petty bureaucrats who insist you pay their toll to proceed, or demoralized and cynical opportunists who just go along to get along.

sure, there are risks, but take them. make a thing for people who take care of other people. this is for a woman who takes care of her husband with alzheimers, or a man who takes care of his wife with parkinsons. fuck the system. make something someone wants.

good luck.

Re: Show HN: Kate's App

#28

Post by otterley » Thu, Jan 09, 2025, 6:31 PM UTC

roegerle wrote: post #17

So HIPAA isn't rocket science and HHS provides plenty of HIPAA guidance. Kate's App isn't providing healthcare so HIPAA doesn't apply.

The site might be deemed a Business Associate, depending on the specific facts, which we don't fully possess. That's why I recommended the owner seek counsel.

Re: Show HN: Kate's App

#29

Post by InsideOutSanta » Thu, Jan 09, 2025, 6:31 PM UTC

metalliqaz wrote: post #13

i_love_retros wrote: post #10

> You data will not be sold, shared, or given away. Your medical data is the most private data you have, and we respect that. So you're hack proof and idiot employee proof?

Is any company?

No, but I guess a product like this should be built in a way that the company doesn't have access to unencrypted data in the first place.

Re: Show HN: Kate's App

#30

Post by otterley » Thu, Jan 09, 2025, 6:32 PM UTC

jph wrote: post #21

otterley wrote: post #3

If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…

> Whenever you touch this kind of data, regulatory regimes like HIPAA apply, My understanding is you're an actual attorney, yes? Can you shed any light on this area...? My understanding is HIPAA and similar laws aren't applied as a result of a user disclosing their own information for their own purposes. For example, you can freely put your own personal medical information into Google Docs, Apple Notes, Facebook post…

I can't provide legal advice here; sorry. But I will say that there is a pretty big difference between hosting arbitrary customer-provided data where the customer can enter either kitchen recipes or medical data at their choosing, and stating that your service is intended to store PHI and attracting such information as a result.