Live data from Hacker News

Programmable Fax – API for sending and receiving faxes

twilio.com

111–120 of 174 posts

Re: Programmable Fax – API for sending and receiving faxes

#111

This has been kicked around for a really long time and I'm happy they finally launched it. Around 2013 or so, one of the junior engineers on the Twilio Voice team pitched his innovation week project with a single slide saying "Fax: The time is now." The time has finally arrived! Congrats John.

[deleted]

Re: Programmable Fax – API for sending and receiving faxes

#112

This has been kicked around for a really long time and I'm happy they finally launched it. Around 2013 or so, one of the junior engineers on the Twilio Voice team pitched his innovation week project with a single slide saying "Fax: The time is now." The time has finally arrived! Congrats John.

I have previously integrated with eFax in 2010, so an internet fax provider is not new to me, but forgive my ignorance as I haven't visited the space in a while. Which innovation are you excited about and referring to? From the comments it seems to be 'developer friendly API' or 'Simplicity in pricing' as the to big draws, just curious what has changed since my last days?

Re: Programmable Fax – API for sending and receiving faxes

#113

Earlier quoted context omitted.

How long does it take to send a page of fax? Their pricing is 0.007 per minute. I haven't seen many fax machines take more than a minute per page, but they would have to take 10 minutes to catch up to your pricing. Edit: Fixed time to comparable pricing.

Quick answer is that it depends on what's on the page. It can be as quick as a minute or significantly longer if there are images or lots of data the page.

That's fair but how many pages take more than 10 minutes?

Re: Programmable Fax – API for sending and receiving faxes

#114
post #96
post #88

Earlier quoted context omitted.

I'm in healthcare. I'm not kidding you, we got an 800 page fax last month from one of our clients. It wasn't a generated e-fax either, we received it electronically (we use sfax), but the lady who sent it literally printed 800 pages and put them on her fax machine. It isn't the business opportunity that is the problem (that is huge), it is the all of the HIPAA/HITECH regulations which creep into every part of your bu…

can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applica…

I wouldn't think that a Fax API provider would be exempt under the conduit exception of HIPAA/HITECH. You couldn't guarantee that the API vendor wasn't sniffing/storing/protecting data while transmitting the data between entities. You can read more about this exception here: http://www.hitechanswers.net/when-does-the-hipaa-conduit-exc...

You would facilitate that transfer by having both parties of business associates/covered entities entering a legally binding business associates agreement to outline how PHI would be protected.

Scrypt is a company that does faxing in the health tech space today and they sign BAAs and went through a HITRUST assessment.

EDIT:

So, maybe let me clarify what I mean about facilitating that transfer of data.

So, let's say there is:

Vendor ----> Health Care Provider

Even if you are sending data over TLS or some other encrypted protocol, the Vendor and the Health Care Provider need to have an agreement to protect patient data and which restrict what can be done with the PHI being transmitted. If you add a new party to this equation, like:

Vendor ----> Twilio ----> Health Care Provider

Even if you encrypt the data to Twilio and Twilio "promises" to not store the data and promises to encrypt the data when sending it down stream, promises aren't good enough in the eyes of HIPAA/HITECH. You need to have an agreement in place like a Business Associates Agreement in which all parties agree to protect PHI. You can read more about what these agreements commonly outline here: https://datica.com/academy/business-associate-agreements/

There are exceptions to this referred to as the "Conduit Exception" of HIPAA which were clarified in 2013. This doesn't really apply to API vendors or someone like cloudflare. It applies more to phone carriers, postal services and ISPs.

It's a complex topic, but I can keep jamming to discuss some of the nuances.

Re: Programmable Fax – API for sending and receiving faxes

#115

This has been kicked around for a really long time and I'm happy they finally launched it. Around 2013 or so, one of the junior engineers on the Twilio Voice team pitched his innovation week project with a single slide saying "Fax: The time is now." The time has finally arrived! Congrats John.

Actually though! This has been an internal meme since then, there's been PRs for implementing it just hanging around for years =P I had to check the date to make sure it wasn't an April Fools joke. Congrats Twilio!

Depends on what time zone you're in ;)

Re: Programmable Fax – API for sending and receiving faxes

#116
post #96

Earlier quoted context omitted.

can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applica…

I wouldn't think that a Fax API provider would be exempt under the conduit exception of HIPAA/HITECH. You couldn't guarantee that the API vendor wasn't sniffing/storing/protecting data while transmitting the data between entities. You can read more about this exception here: http://www.hitechanswers.net/when-does-the-hipaa-conduit-exc... You would facilitate that transfer by having both parties of business associates…

You actually can guarantee the transmission of information from one entity to another without sniffing or alteration...that is how internet transport layer security works....our API is built on those principles.

Of course there may be other caveats that I am not aware of, I don't know much about HIPAA.

EDIT:

You don't need to trust twilio (or any intermediary)...You can transmit encrypted information end-to-end without any risk that the intermediary can access it. That is the solution we've created with our API, you can see the full docs here: https://www.cipheredtrust.com/doc/

Re: Programmable Fax – API for sending and receiving faxes

#117
post #109
post #62

Earlier quoted context omitted.

The short answer is 'yes' — fax machines are actually a pretty great solution to this problem. If you think about it, there isn't really that much overhead for having a fax line and a $40 fax machine vs running a full computer + printer combo, set up is trivial, faxes have a very well-understood track record, and the 'sender' gets direct feedback on whether or not the physical document was successfully delivered. If…

I'm not looking for startup ideas in this domain, I was just wondering "in general". If the PC + printer is already there (surely it has to be for accounting, etc.) why have a fax. But ok, if the fax and the phone line cost next to nothing and it "just works", then sure it makes a lot of sense.

A lot of these restaurants _do_ have a PC + printer in a back room or office somewhere. If the restaurant is owned by a group (or small chain), that setup may only exist at one location.

They can (and do!) put the fax machine right by the kitchen.

Re: Programmable Fax – API for sending and receiving faxes

#118
post #96
post #88

Earlier quoted context omitted.

I'm in healthcare. I'm not kidding you, we got an 800 page fax last month from one of our clients. It wasn't a generated e-fax either, we received it electronically (we use sfax), but the lady who sent it literally printed 800 pages and put them on her fax machine. It isn't the business opportunity that is the problem (that is huge), it is the all of the HIPAA/HITECH regulations which creep into every part of your bu…

can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applica…

Aren't faxes unencrypted? Are we living in a world where tapping phone lines is impossible?

Re: Programmable Fax – API for sending and receiving faxes

#119
post #96
post #88

Earlier quoted context omitted.

I'm in healthcare. I'm not kidding you, we got an 800 page fax last month from one of our clients. It wasn't a generated e-fax either, we received it electronically (we use sfax), but the lady who sent it literally printed 800 pages and put them on her fax machine. It isn't the business opportunity that is the problem (that is huge), it is the all of the HIPAA/HITECH regulations which creep into every part of your bu…

can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applica…

HIPAA compliance has nothing to do with encryption, and little to do a traditional tech sense of privacy/security. If you handle patient information, encrypted or otherwise, you are subject to compliance hurdles (with the exception of extremely-limited-scope entities treated as "conduits", but the policy does not distinguish between ciphertext and plaintext when it comes to PHI). Fax, email, SMS, etc are all (fairly explicitly) within the realm of things subject to BAA for compliance.

HIPAA (and a broad swath of other tech legislation) is not necessarily indicative of actual security. For example, HIPAA-compliant hospitals are currently seeing a rash of ransomware attacks; any meaningful definition of computer security would include defenses against these kinds of things. HIPAA is domain-specific policy with a poor understanding of the domain. That's (in no small part) a bilateral educational failure; technology makers don't understand policy and policy makers don't understand technology.

Re: Programmable Fax – API for sending and receiving faxes

#120
post #96

Earlier quoted context omitted.

can you elaborate on the HIPAA concerns related to faxing/transmitting health data? Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination? If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns? We've developed a privacy preserving trust relay protocol which might be applica…

Aren't faxes unencrypted? Are we living in a world where tapping phone lines is impossible?

Phone carriers are exempted under the carrier exception of HIPAA. Same thing with phone calls. API transactions are not exempted, even when encryption is used or data is not persisted in the middleware.

http://www.hitechanswers.net/when-does-the-hipaa-conduit-exc...

Post reply on HN