51–60 of 192 posts
So HIPAA isn't rocket science and HHS provides plenty of HIPAA guidance. Kate's App isn't providing healthcare so HIPAA doesn't apply.
The site might be deemed a Business Associate, depending on the specific facts, which we don't fully possess. That's why I recommended the owner seek counsel.
Who owns the data and where it is stored?
Also, how identifiable is the data? Can a (US state) government agency subpoena data for individual users? Does the app/company fall under HIPAA regulation? If it does, what security & privacy measures are in place to guarantee compliance? If it does not, what security & privacy measures are in place to prevent government fishing expeditions? Finally, what security & privacy measures are in place to prevent app devel…
Yes. Two features high on my list of todos: 1) download all your data; 2) delete all data from the site.
The second is a bit more complicated, since multiple family members may have access to the same data, and may have different opinions on deleting it. I'll work it out.
Otherwise, you have only my integrity. I'm not looking to sell it, but I would love to hand this over to someone with more resources and bigger pockets. If I ever do, I would want those reassurances from them first, and I would definitely give all users fair warning, so they can pull out if they don't have the same confidence I do.
Privacy concerns aside, I don't really understand what the point of this is, to be honest. You can already add family/caregivers as authorized users on a MyChart (Epic) profile, which is an actual source of truth, not a separate data store that you need to update manually. This seems like a good experiment in building a CRUD app, but I'd recommend doing that with something with less liability.
> I don't really understand what the point of this is, to be honest [...] on a MyChart (Epic) profile As someone who never heard of either MyChart nor Epic, I'm guessing it could be useful for people like me who don't have those things.
Great idea! - What country/ies do you accept users from and which jurisdiction do you store their data in? - Get a HIPPA/GDPR/PHIPA audit by a legal professional ASAP!
So HIPAA isn't rocket science and HHS provides plenty of HIPAA guidance. Kate's App isn't providing healthcare so HIPAA doesn't apply.
This is not true. I'm not a lawyer, but I am in the healthcare field. HIPAA very much applies to this type of app or any other type of app that may deal in personally identifying information (PII) related to healthcare.
I don't want to repeat other comments here; but this app smells of a very dangerous attitude: Built with love by novices with grand intentions, with complete blindness to the real consequences that happen when novices are ignorant in their field. If your goal is to "find a learning project," I suggest finding a very different "learning project." Otherwise, keep "Kate's app" private, word-of-mouth, invite-only for und…
How do you know that the authors are novices with "complete blindness" to real consequences? Where are you getting the "find a learning project" goal from? It sucks that you've been burnt by that before, but it sounds like your employer was the one who screwed you there, not the author of the application.
The sparse documentation makes claims about privacy and security, but there is no evidence to back those claims.
I don't want to repeat other comments here; but this app smells of a very dangerous attitude: Built with love by novices with grand intentions, with complete blindness to the real consequences that happen when novices are ignorant in their field. If your goal is to "find a learning project," I suggest finding a very different "learning project." Otherwise, keep "Kate's app" private, word-of-mouth, invite-only for und…
How do you know that the authors are novices with "complete blindness" to real consequences? Where are you getting the "find a learning project" goal from? It sucks that you've been burnt by that before, but it sounds like your employer was the one who screwed you there, not the author of the application.
Earlier quoted context omitted.
Also, how identifiable is the data? Can a (US state) government agency subpoena data for individual users? Does the app/company fall under HIPAA regulation? If it does, what security & privacy measures are in place to guarantee compliance? If it does not, what security & privacy measures are in place to prevent government fishing expeditions? Finally, what security & privacy measures are in place to prevent app devel…
> app developer having a change of heart Yes. Two features high on my list of todos: 1) download all your data; 2) delete all data from the site. The second is a bit more complicated, since multiple family members may have access to the same data, and may have different opinions on deleting it. I'll work it out. Otherwise, you have only my integrity. I'm not looking to sell it, but I would love to hand this over to s…
I know it's been said elsewhere, but you need a lawyer. This isn't something for you to work out, it's something for you to clearly understand your legal obligations, and what your exposure is based on which jurisdictions a user might log in from.
contra view to these comments: keep going. I worked in health information privacy and security longer than all of them and the number of sincere people in it is diminishingly small. the field has become infested with gatekeeper nerds and petty bureaucrats who insist you pay their toll to proceed, or demoralized and cynical opportunists who just go along to get along. sure, there are risks, but take them. make a thing…
What a claim to make.