41–50 of 192 posts
So HIPAA isn't rocket science and HHS provides plenty of HIPAA guidance. Kate's App isn't providing healthcare so HIPAA doesn't apply.
HIPAA very much applies to this type of app or any other type of app that may deal in personally identifying information (PII) related to healthcare.
* More screenshots/use cases.
* Information about who you are/why it's called Kate's App. I think that especially for single/small dev teams, this can really help build trust and interest.
* Said elsewhere, but a publicly available privacy policy. Also not seeing any after signing up. Big red flag.
* IMO, don't have usernames AND emails at sign up. Choose one.
* Needs padding on either side. Other formatting issues too, but that was the most glaring one.
If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…
> Whenever you touch this kind of data, regulatory regimes like HIPAA apply, My understanding is you're an actual attorney, yes? Can you shed any light on this area...? My understanding is HIPAA and similar laws aren't applied as a result of a user disclosing their own information for their own purposes. For example, you can freely put your own personal medical information into Google Docs, Apple Notes, Facebook post…
Anybody who is a healthcare provider, anybody who gets paid to do anything that smells even a little bit like health care shouldn't touch this with a ten foot pole. They shouldn't look at it or touch it or think about it very intensely.
If you don't want to be in violation, don't receive medical information, don't store it, don't advertise that you handle it in any way.
Good advice:
- don't do anything at all that suggests that you will handle anything that even slightly hints it is storing, transmitting, or in any way touching healthcare information without being HIPAA compliant.
- especially don't do this as a side project, have a corporate structure with a very solid liability shield and don't do anything to pierce the veil
- do you want to avoid a 5,6, or 7 digit liability? Do everything you can to appear to be trying in good faith to follow the law and comply with regulations. Do things. Keep records of doing those things.
- even if you're _not_ required to, look up and follow the regulations, better yet, actually be HIPAA compliant even if it's not required. Many of these things you should be doing anyway even in very different fields.
- for God's sake get a lawyer and don't ask for advice on the Internet. Pay for the time for someone to sign off on what you do and whether or not you're inside the law
Privacy concerns aside, I don't really understand what the point of this is, to be honest. You can already add family/caregivers as authorized users on a MyChart (Epic) profile, which is an actual source of truth, not a separate data store that you need to update manually. This seems like a good experiment in building a CRUD app, but I'd recommend doing that with something with less liability.
It's not a place where I'm going to store contact information for all my doctors, or appointments for doctors that aren't at that clinic, or all my prescriptions and all the pharmacies.
When your daughter is reacting badly to her new chemotherapy, and running fevers and throwing up, and somebody needs to call her palliative care specialist and it needs to be you, not her, then where will you find the specialist's phone number?
I hope you'll never be there, but if you are, I think you'll understand.
Yeah... this is a lawsuit waiting to happen. Medical data is NOT something you handle with a hobby project. No privacy policy, no real information about the owner behind it. Seems all "trust me, it's private, I pinky swear".
That, and also let me tell you about a thing called margins. They help text not run into the edges of the screen. I don't blame you for not using them though since evidently you never looked at your page on mobile ;)
contra view to these comments: keep going. I worked in health information privacy and security longer than all of them and the number of sincere people in it is diminishingly small. the field has become infested with gatekeeper nerds and petty bureaucrats who insist you pay their toll to proceed, or demoralized and cynical opportunists who just go along to get along. sure, there are risks, but take them. make a thing…
Thank you everybody for your comments. Comments on legal issues: I absolutely agree and 100% plan to get legal advice. In the meantime, if you have personal experience, I would love to learn from you. Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and…
Putting aside all the legal issues, I would like to see more details of what it does before I sign up. Seems like you need to register yourself and then get all your family/carers to register and then link their accounts to yours? There should be some screen shots of the app in action (with dummy data of course). Shame this is such a legal minefield. I do not think you should put this on GA.
High on my list. Or youtube, or something like that.
Thank you everybody for your comments. Comments on legal issues: I absolutely agree and 100% plan to get legal advice. In the meantime, if you have personal experience, I would love to learn from you. Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and…