91–100 of 192 posts
>> You data will not be sold, shared, or given away. Your medical data is the most private data you have, and we respect that. Unfortunately the bad actors have destroyed trust so much that I don't trust anyone no matter the words nor how authentic you sound.
Sadly, it is also vert HN like in the not so good sense. Unlike the software world, the real world is not ours to program as we see fit. In the real world, laws matter. And I am concerned that you haven't really read upon the consequences of doing an app like yours without any due diligence. You can't just use people's health data like that.
Anyone using this app could potentially sue you as you are likely breaking the law of the country you live in (I am going to guess it is an Anglo-Saxon country).
You should asap bring the app down, contact all users, send them their info, delete them from your servers, notifying them of that and get a lawyer specialising in health related law. With their assistance, you can build an organisation to build the app. This should also limit your liability.
Earlier quoted context omitted.
MyChart is Epic’s patient frontend.
What's Epic?
Putting aside all the legal issues, I would like to see more details of what it does before I sign up. Seems like you need to register yourself and then get all your family/carers to register and then link their accounts to yours? There should be some screen shots of the app in action (with dummy data of course). Shame this is such a legal minefield. I do not think you should put this on GA.
> screenshots High on my list. Or youtube, or something like that.
"Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and stays in the family."
Insofar as no providers or non-family use this, developer may have a point: my comment's covered-entity reasoning can be disregarded.
---
Not saying don't do YouTube, there's a persona who wants to learn from being talked to and shown.
But there's a less online (socially noisy) persona who prefers to read, see, and take in information far faster than a video. So don't skip the screenshots!
PS. I participated in the first patient centered groupware app 15 years ago, sold to the provider networks, so all providers a patient is ping-ponged to can interact as if a virtual team with the patient.
Your idea is viable, and giant hospital networks will buy it. But the top comment on this thread is likely dead right. You likely need to be HIPAA compliant for the providers to participate, regardless whether you sold the app to the patient or to the providers. Because unlike a personal notes app, your entire premise is info sharing among parties.
There is possibly a model for this that is technically outside HIPAA, but what you're showing / saying doesn't sound like it's navigated that.
Even if you use that potentially compliant model, it's then highly unlikely the providers will play ball, as then they'd have to be running as many apps as they have patients and they are too busy and already have to know too many systems. Even if they felt like setting a precedent of installing whatever apps patients ask them to use (they don't), the last thing they want is yet another place to redundantly key in information/communications. (They are required to have a record.) To get around that, you'd have to integrate with what they have, and boom, HIPAA again.
Earlier quoted context omitted.
Are they a covered entity?
While I agree that they probably aren't, their intended customer base is. And even so, nothing precludes people from pursuing civil damages if there's a data breach - this is far more likely with sensitive data coming from a medical provider to a third party. And as has been hinted at, the lack of professional presentation is going to hurt a lot, and people will immediately ask "can I trust this platform with any of…
This is a lovely idea. Very HN like in the good sense. Sadly, it is also vert HN like in the not so good sense. Unlike the software world, the real world is not ours to program as we see fit. In the real world, laws matter. And I am concerned that you haven't really read upon the consequences of doing an app like yours without any due diligence. You can't just use people's health data like that. Anyone using this app…
For example, I believe Brooke Shields told the world she had post-partum depression and was prescribed some anti-depressant and felt it helped her.
https://www.webmd.com/depression/postpartum-depression/featu...
That's "medical information" about "a prescription". She could have, instead, shuffled it into some rando app, and shared it with her family. I don't think any HIPAA laws were broken.
Of course, US laws https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must...
The above doesn't describe anything about private parties. If this "Kate" is some rando app developer, they can do whatever they like. Anyone who is willing to trust a random developer with their information can do so afaict.
IANAL and YMMV etc.
This is a lovely idea. Very HN like in the good sense. Sadly, it is also vert HN like in the not so good sense. Unlike the software world, the real world is not ours to program as we see fit. In the real world, laws matter. And I am concerned that you haven't really read upon the consequences of doing an app like yours without any due diligence. You can't just use people's health data like that. Anyone using this app…
I am not sure that if you choose to freely share your medical information with people of your choice, it's protected or governed by HIPAA or protected PII, per se. For example, I believe Brooke Shields told the world she had post-partum depression and was prescribed some anti-depressant and felt it helped her. https://www.webmd.com/depression/postpartum-depression/featu... That's "medical information" about "a prescr…
"Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and stays in the family."
Insofar as no providers or non-family use this, developer may have a point: my comment's covered-entity reasoning can be disregarded.
---
> Anyone who is willing to trust a random developer with their information can do so afaict.
No, not "anyone" in a multi-party app when "someone" is regulated.
This reasoning (a patient can choose to disclose) doesn't apply here, as the app expects providers to info-share new info, ongoing.
The providers are regulated, they have to keep records, and their sides of their tools have to be covered.
That said, even some U.S. national insurance companies bury a clause in their agreement where, to your point, the patient agrees to sort of declassify their info such that it's (the insurer company's theory goes) no longer considered HIPAA and the insurance company can go bananas with it (e.g., sell it to drug companies).
I had lawyers look into this on behalf of our firm benefits, and we challenged that clause. The national insurance company everyone has heard of instantly gave us a new employee insurance agreement without that clause, which suggests to me they knew it was dicey. (Imagine pinging Google and them dropping a clause from their TOS "just for you". That would only happen if they knew it didn't have legs.)
But, dicey or not, it suggests a path to try if you want to attempt this!
This is a lovely idea. Very HN like in the good sense. Sadly, it is also vert HN like in the not so good sense. Unlike the software world, the real world is not ours to program as we see fit. In the real world, laws matter. And I am concerned that you haven't really read upon the consequences of doing an app like yours without any due diligence. You can't just use people's health data like that. Anyone using this app…
I am not sure that if you choose to freely share your medical information with people of your choice, it's protected or governed by HIPAA or protected PII, per se. For example, I believe Brooke Shields told the world she had post-partum depression and was prescribed some anti-depressant and felt it helped her. https://www.webmd.com/depression/postpartum-depression/featu... That's "medical information" about "a prescr…
The problem is that OP literally mentions "medical caregiver" as distinct from "families" which can be interpreted to mean someone that operates as covered entity. That alone puts OP under the risk of being sued and being punished with a very large fine. All a user needs to do is put their data there, share the info with their care assistant who works for a health company. Once that happens, OP is breaking the law.
If you're dealing with personal health information (PHI), I would advise you to temporarily close your site and hire a lawyer straight away. Whenever you touch this kind of data, regulatory regimes like HIPAA may apply, and you need to be extremely careful. There's not a HIPAA compliance or even a privacy policy statement available on your front page. See https://www.hhs.gov/hipaa/for-professionals/privacy/laws-reg..…