Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Delve (YC W24) – HIPAA compliance as a service

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 116 posts

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#61

Post by leetrout »

selinkocalar wrote: post #32
fishpen0 wrote: post #20

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are a…

We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. So far, we haven't gotten any major requests for expanding to other cloud providers and most of our incoming customers are already on AWS anyways. One of the main reasons why healthcare players were moving onto Azure was for in-built HIPAA compliant OpenAI access. We've been able to help our customers directly sign BAAs with Op…

> We currently support AWS but use terraform for deployment, which is pretty cloud agnostic.

Nothing could be further from the truth.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#62

Post by kstrauser »

technics256 wrote: post #26
fishpen0 wrote: post #20

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are a…

Interesting, haven't heard of this. Always figured aws and gcp were ahead of azure in terms of Healthcare

AWS is fine for building out HIPAA services. They have a decent portal at https://aws.amazon.com/compliance/hipaa-compliance/ explaining their compliance, which services you can use, and how to get them to sign a Business Associate Agreement (BAA).

I haven't done healthcare stuff in GCP or Azure so I can't compare, but AWS is _not_ a blocker for HIPAA.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#63

Post by kstrauser »

debarshri wrote: post #30
dekhn wrote: post #28

I remember early in Google Cloud I was working with a Google PM on health-related projects (Google Cloud Genomics). The PM was our ostensible expert on HIPAA, and explained many details (such as BAA). The one funny thing they said is "there is no such thing as HIPAA compliance, that term is meaningless". And I don't really understand what they meant, but I think they must have been wrong (even though they were suppos…

You PM is right. Unlike SOC2, you dont get a certification. More details here [1] [1] https://compliancy-group.com/what-is-a-hipaa-certification/

However, if you want to do business with any reasonable size of healthcare org, you're eventually gonna have to get a HITRUST report.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#64

Post by doctorpangloss »

leetrout wrote: post #61
selinkocalar wrote: post #32

Earlier quoted context omitted.

We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. So far, we haven't gotten any major requests for expanding to other cloud providers and most of our incoming customers are already on AWS anyways. One of the main reasons why healthcare players were moving onto Azure was for in-built HIPAA compliant OpenAI access. We've been able to help our customers directly sign BAAs with Op…

> We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. Nothing could be further from the truth.

You’re right but the kind of people who buy this service buy into the perception that Terraform is cloud agnostic, and perception is reality.

Another POV is that the compliance companies sell the holistic social experience of compliance. The people for whom this matters need checkboxes and don’t mind paying for consulting disguised as a CSA. In fact they may even prefer it.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#65

Post by Spooky23 »

dekhn wrote: post #58
Spooky23 wrote: post #52

Earlier quoted context omitted.

It's a weird topic. I always laugh about how "difficult" HIPAA compliance is often portrayed as in online forums. It's a reminder to me of how important due diligence is. Of the various regulatory regimes, HIPAA is not particularly challenging, and if it is, I'd be concerned with doing business with the entity in other contexts.

What I laugh about is that more than once I have had to explain HIPAA to my corp lawyer. I've had actual discussions where the lawyers proposed an immense amount of work, followed by me explaining that our work doesn't fall into the scope of HIPAA and therefore we do not need to comply with it or get any certification or sign a BAA at all. "But... .but .... we should comply anyway just to be on the safe side!".

Few things are more annoying than a lazy attorney prioritizing personal CYA vs representing the client or employer.

My favorite example is a clown who decided when I was on vacation that we should “voluntarily comply” with IRS 1075 guidelines, in a context that had absolutely nothing to do with the IRS.

The motivation was to literally reuse work done for another, unrelated client and protect.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#66

Post by Clubber »

agilob wrote: post #42
fishpen0 wrote: post #20

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are a…

I'm in banking and we have similar pressure to leave AWS, but for different reasons. Simply too many banking services are already on AWS, and if a single could goes down it mustn't take most of banking infrastructure of a country.

I figured most of the big banks still use AS400s. Have they finally shed those?

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#67

Post by a_gnostic »

a_gnostic wrote: post #8

It does more than just protecting sensitive health information, it also governs how billing works, so if you've ever wondered why some Dr. you never met is sending you bills in the thousands of dollars; HIPAA is where you can find out why!

Spoiler: Anyone who touches the patient, anyone who has a conversation with the patient, anyone who measures stuff of the patient, doctors consulted by doctors also get to charge.

So that's why suddenly every nurse wants to talk to you, check your blood pressure, and a different nurse wants your blood oxygenation… and that guy that walked by who greeted the doctor seeing you, and talked about how much the 49ers sucked last weekend, and flirted with the nurse? Bill's in the mail.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#68

Post by Sephr »

selinkocalar wrote: post #45
imglorp wrote: post #27

Sort of related: it seems like compliant providers and services are carrying the burden of patient privacy in good faith, securing the front door. Meanwhile, there are open tent flaps on the sides and back. It's hard to do the right thing while there are minimal regs and enforcement on the rest of the ecosystem. Eg, Tracking on medical sites let Meta go to town -- https://www.theverge.com/2022/8/2/23288612/meta-hospt…

Yes, you’re correct in your assertion that infrastructure policies are just one part of the puzzle. In conjunction with our preconfigured deployments, we provide customers a set of legal policies we’ve worked with former US Attorneys to closely align with the spirit of HIPAA enforcement. We’ve all seen the countless byteDance and Meta cookie data leakage headlines on insurance and healthcare portals, and provide cust…

> [we] provide customers with notice to remove trackers, or sign BAAs with user metrics companies where possible

Do you provide any technical solutions to help your customers control these trackers in accordance with HIPAA and privacy laws, or do you refer your customers to third-party privacy solutions to accomplish this?

You expressed disdain for "hitting checkboxes," yet your solutions to this specific problem appear to be more checkboxes.

Asking customers to remove a tool from their site or request tool vendors to sign a contract is helpful, but it forces customers to make tough decisions: Do I lose revenue by completely removing a tool? Can I trust a vendor to follow their BAA?

Technical compliance solutions can remove this source of uncertainty by directly controlling tracker behavior on a fine-grained level.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#69

Post by Sephr »

selinkocalar wrote: post #16
ramzez wrote: post #7

is there pricing information?

We charge a fixed annual fee — zero usage-based costs. We deploy all on your own AWS cloud so you're not paying any marked up fees or being faced with surprise bills. If you have any thoughts on this would love to hear them!

Can you provide any numerical information regarding the pricing of your service? e.g. Variable pricing thresholds, target ICP budget, and service tiers are all relevant information here.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#70

Post by chevman »

So what you may have already discovered, is HIPAA compliance, HiTrust certification, BAAs, etc are table stakes for servicing covered entities in the healthcare space.

They are all preludes, however, to agreeing to liability amounts/indemnification in the actual contract.

This is why, as an example, most healthcare orgs end up moving away from Google. Google (to my knowledge, which includes large deals at F50 level), will not contractually agree to any kind of financial or legal liability for data breaches, hacks etc.

Microsoft (and to a lesser extent Amazon) will agree to such terms if you're a big enough account, and generally already have some kind of framework in place with your procurement dept likely that simply needs to be amended.

This is also why larger healthcare orgs are reticent to work with smaller, less well capitalized startups in the ecosystem. The liability alone should something go wrong would potentially vaporize your company, and would definitely lead to uncomfortable conversations with your investors (who maybe, might also have large holdings in the larger healthcare orgs and be incented to not do stupid things that would create massive liabilities!).

Post reply on HN