iCloud Uploads Local Data Outside of iCloud Drive • Hacker News Board

Re: iCloud Uploads Local Data Outside of iCloud Drive

#31

Post by patio11 » Sun, Oct 26, 2014, 2:43 PM UTC

kps wrote: post #18

Last I looked, iCloud was not HIPAA¹-compliant. Health-care workers who previously could have iCloud enabled, as long as they did not use it for HIPAA-covered documents, may be in for a big and expensive surprise. ¹ http://www.hhs.gov/ocr/privacy/hipaa/understanding/

Although non-compliant activity with regards to e.g. spreadsheets containing patient data is extraordinarily widespread [+], you're correct, putting a spreadsheet with PHI on iCloud (whether you intended to or not) is a reportable breach.

(Not a lawyer, but I have to care about this, for professional reasons.)

[+] Say, emailing in the clear about PHI. This is extraordinarily common even among people who theoretically know better.

Re: iCloud Uploads Local Data Outside of iCloud Drive

#32

Post by [deleted] » Sun, Oct 26, 2014, 2:44 PM UTC

epistasis wrote: post #30

kps wrote: post #18

Last I looked, iCloud was not HIPAA¹-compliant. Health-care workers who previously could have iCloud enabled, as long as they did not use it for HIPAA-covered documents, may be in for a big and expensive surprise. ¹ http://www.hhs.gov/ocr/privacy/hipaa/understanding/

Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA. And anyone working with data under HIPAA had better know this already!

[deleted]

Re: iCloud Uploads Local Data Outside of iCloud Drive

#33

Post by hbbio » Sun, Oct 26, 2014, 2:45 PM UTC

xenadu02 wrote: post #22

Apple is not a "PRISM" partner; I thought we all agreed that this was when the NSA discovered goto fail and/or some jailbreak exploits.

Apple joined PRISM a few months after Steve Jobs death.

Re: iCloud Uploads Local Data Outside of iCloud Drive

#34

Post by patio11 » Sun, Oct 26, 2014, 2:45 PM UTC

epistasis wrote: post #30

kps wrote: post #18

Last I looked, iCloud was not HIPAA¹-compliant. Health-care workers who previously could have iCloud enabled, as long as they did not use it for HIPAA-covered documents, may be in for a big and expensive surprise. ¹ http://www.hhs.gov/ocr/privacy/hipaa/understanding/

Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA. And anyone working with data under HIPAA had better know this already!

Right, which is why I don't have any HIPAA-covered data in Dropbox, but my risk assessment does not include "I have Dropbox installed on my machine, ergo, I need to be careful to never access HIPAA-covered info from my machine", which is apparently the level of care I now need for Yosemite. (An upgrade which just got delayed indefinitely, for the obvious reason.)

Re: iCloud Uploads Local Data Outside of iCloud Drive

#35

Post by kuschku » Sun, Oct 26, 2014, 2:47 PM UTC

acd wrote: post #29

I do not see any proof in the form of ip addresses to the location where this documents are uploaded and that being part of PRISM. What IP addresses?

They are uploaded to iCloud, which belongs to Apple. Apple — as an US corporation — has to comply with US laws and has to support ongoing US criminal investigations, including secret agencies.

Re: iCloud Uploads Local Data Outside of iCloud Drive

#36

Post by quesera » Sun, Oct 26, 2014, 2:49 PM UTC

sneak wrote: post #25

quesera wrote: post #23

Interesting, but: There are two kinds of users in this scenario. Those who don't care (99%) and those who do. If you count yourself among the latter group, as I do, then it's always solid advice to choose actions which clarify your intentions. In this case: - don't use iCloud - don't use iCloud sync for the app you use for private data - do explicitly choose to save the file locally - don't enable new features like C…

I'm not angry, but it does violate the principle of least surprise and the document model that's been in use for text editors forever . I opted in to iCloud Drive to synchronize files - files I chose to store in iCloud. I did not opt in to synchronize my unsaved files in apps not currently supported by Continuity, nor was there any warning or indication that that would occur. How would you feel if the OS, without war…

Right, well I agree with you almost entirely.

My only hesitation is that you and I have to recognize that we are on the fringes of the fringe, and be hyper-vigilant.

This behaviour is only surprising if you get lax (as I was, too) about evolving functionality.

My point about vim is that for me, it's a purposeful simplification. I do sometimes wish for a more flexible note taking app, but I know that it would take an earthquake of change for vim to sprout a file sync feature that tied into iCloud. And I value that, a lot.

Re: iCloud Uploads Local Data Outside of iCloud Drive

#37

Post by epistasis » Sun, Oct 26, 2014, 2:52 PM UTC

patio11 wrote: post #34

epistasis wrote: post #30

Earlier quoted context omitted.

Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA. And anyone working with data under HIPAA had better know this already!

Right, which is why I don't have any HIPAA-covered data in Dropbox, but my risk assessment does not include "I have Dropbox installed on my machine, ergo, I need to be careful to never access HIPAA-covered info from my machine ", which is apparently the level of care I now need for Yosemite. (An upgrade which just got delayed indefinitely, for the obvious reason.)

You're a braver person than I then. I wouldn't download HIPAA data to a machine with Dropbox on it, anymore than I would be downloading protected research data to such a machine. But then, I'm not a doctor so I don't deal with one-off patient info, so it's easy for me to maintain separation.

Though if this is actually a thing that many people want to do, perhaps the new Blackberry OS actually does something that people need...

Re: iCloud Uploads Local Data Outside of iCloud Drive

#38

Post by sneak » Sun, Oct 26, 2014, 2:55 PM UTC

quesera wrote: post #36

sneak wrote: post #25

Earlier quoted context omitted.

I'm not angry, but it does violate the principle of least surprise and the document model that's been in use for text editors forever . I opted in to iCloud Drive to synchronize files - files I chose to store in iCloud. I did not opt in to synchronize my unsaved files in apps not currently supported by Continuity, nor was there any warning or indication that that would occur. How would you feel if the OS, without war…

Right, well I agree with you almost entirely. My only hesitation is that you and I have to recognize that we are on the fringes of the fringe, and be hyper-vigilant. This behaviour is only surprising if you get lax (as I was, too) about evolving functionality. My point about vim is that for me, it's a purposeful simplification. I do sometimes wish for a more flexible note taking app, but I know that it would take an…

This is OS functionality, so it would be akin to iCloud helpfully synchronizing your vim recovery files across your Macs (via a roundtrip to iCloud) without you ever asking it to - not a change in vim.

This is why this is worth sounding the alarm over - it's an OS-level change that affects all apps, not just Apple's.

Re: iCloud Uploads Local Data Outside of iCloud Drive

#39

Post by frostmatthew » Sun, Oct 26, 2014, 2:59 PM UTC

epistasis wrote: post #30

kps wrote: post #18

Last I looked, iCloud was not HIPAA¹-compliant. Health-care workers who previously could have iCloud enabled, as long as they did not use it for HIPAA-covered documents, may be in for a big and expensive surprise. ¹ http://www.hhs.gov/ocr/privacy/hipaa/understanding/

Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA. And anyone working with data under HIPAA had better know this already!

VMware's vCloud Air does: "To help customers comply with HIPAA and HITECH, VMware offers a Business Associate Agreement (BAA) to all interested customers using our US-based data centers."[1]

[Full disclosure: I work on vCloud Air]

[1] http://vcloud.vmware.com/service-offering/security-complianc...

Re: iCloud Uploads Local Data Outside of iCloud Drive

#40

Post by patio11 » Sun, Oct 26, 2014, 3:06 PM UTC

frostmatthew wrote: post #39

epistasis wrote: post #30

Earlier quoted context omitted.

Clouds are almost universally antithetical to HIPAA, it's extremely rare to find a SaaS provider that will sign a HIPAA BAA. And anyone working with data under HIPAA had better know this already!

VMware's vCloud Air does: " To help customers comply with HIPAA and HITECH, VMware offers a Business Associate Agreement (BAA) to all interested customers using our US-based data centers. "[1] [Full disclosure: I work on vCloud Air] [1] http://vcloud.vmware.com/service-offering/security-complianc...

As will AWS, Rackspace, Google, and a few other providers. (List as of "ones I knew of off the top of my head and could quickly verify via Googling.")