Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Delve (YC W24) – HIPAA compliance as a service

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 116 posts

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#71

Post by deathanatos »

selinkocalar wrote: post #32
fishpen0 wrote: post #20

We have investor pressure to use specific cloud providers. This is the Healthcare version of Walmart not letting their partners use AWS. Due to their (Amazon, Google) vertical integration slowly moving in on healthcare turf, many healthcare partners/payers/investors are adding contractual pressure to exit AWS or GCP and move to Azure specifically. Wondering how your cloud support in general looks. Your previews are a…

We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. So far, we haven't gotten any major requests for expanding to other cloud providers and most of our incoming customers are already on AWS anyways. One of the main reasons why healthcare players were moving onto Azure was for in-built HIPAA compliant OpenAI access. We've been able to help our customers directly sign BAAs with Op…

While you're right about the access to AI models on Azure, I wouldn't tie my infrastructure to Azure just for that. Sure, you might have to use them for that service, but ship the queries in & the results back to a cloud of choice; especially LLMs in most uses cases won't represent a huge amount of data; the costs of egress We're (now only partially) on Azure for reasons stated upthread: desire from the industry. We've partially moved since, and the experience as a whole has soured me on Azure as a reliable cloud provider (I've had to engage with support far more often). Their support, in particular, is terrible¹, and a lot of their offerings IME are less stable or harder to work with than AWS. I'm now moderately experienced with GCP, and I think GCP has them beat, too.

¹missed SLAs, a huge desire to close tickets prematurely, failures to address things asked of them, really bad communication skills, constantly divorcing replies into new threads, dredging up asked & answered stuff, repeatedly asking questions covered in the original ticket's opening set of answers, asking the customer for stuff they should know, etc.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#72

Post by FireBeyond »

As someone who has been in healthcare IT for maybe 10 years, comfortable with HIPAA HITECH, SAS70, etc., one thing I took a pause at was:

> Yes! HIPAA auditors have reviewed Delve to ensure that we cover HIPAA requirements.

To me, the word 'review' is doing a bit of heavy lifting. There's a lot of self-attestation in the HIPAA world, a lot of policies and processes - but to my understanding (and forgive me if it is flawed), any actual auditing is on specific implementation, not generalized.

I think your statement is accurate, to be clear - but I think the concern I had was that someone less nuanced or experienced might read something that isn't there into it - i.e. "our tooling has been audited". (Mind you, I also think that someone "less nuanced or experienced" probably shouldn't be heading up a PHI solution, so maybe self-selecting).

Also:

> Our infrastructure has been vetted by cybersecurity and DevOps experts from AWS, Google Cloud, and more.

Similarly, this heavily implies that AWS has done some attestation on your product, which I doubt. For one, in my experience they only partner with compliance partners, and will only attest to their products (and not even all of them).

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#73

Post by FireBeyond »

kstrauser wrote: post #62
technics256 wrote: post #26

Earlier quoted context omitted.

Interesting, haven't heard of this. Always figured aws and gcp were ahead of azure in terms of Healthcare

AWS is fine for building out HIPAA services. They have a decent portal at https://aws.amazon.com/compliance/hipaa-compliance/ explaining their compliance, which services you can use, and how to get them to sign a Business Associate Agreement (BAA). I haven't done healthcare stuff in GCP or Azure so I can't compare, but AWS is _not_ a blocker for HIPAA.

> I haven't done healthcare stuff in GCP

My understanding is that Google will not agree to any of the liability provisions inherent to a BAA, no matter how large your size.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#75

Post by throwkjkbkljbk »

debarshri wrote: post #31
selinkocalar wrote: post #12

Earlier quoted context omitted.

Thanks for the transparency and thoughts on this! We provide a lot of active elements, such as our infrastructure logging/monitoring dashboard, email alerts, and code vulnerability scans every time you git push, so that we aren't just a one-time purchase. We help you be proactive about preventing breaches instead of just integrating with your AWS API and passively monitoring. One of the biggest things about HIPAA is…

Solutions like this wont work in large orgs that have lead to huge ACVs. Would be more happy if you prove me wrong.

No you're right for sure. Aptible is mentioned a few commends down, and is/was basically the same business (compliance focused hosting for small startups). Now Aptible has seemingly pivoted away from that focus and are now trying to compete in the PaaS space. There are a couple of obvious reasons here.

1. You're limiting your TAM to just healthcare startups. Why? 2. After not that long, it doesn't make financial sense for your customers to stick with you. I speak from experience on this one having moved some number of customers off of Aptible in the past. Aptible was charging 10X AWS for a pretty thin wrapper around AWS. At any kind of scale beyond a handful of machines it makes sense to just bite the bullet and hire a devsecops person, who in the end will do more for you.

My advice here is to think bigger. Think about what value the GRC/Security/DevOps teams of bigger orgs are delivering and how you could displace (some) of them.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#76

Post by selinkocalar »

doctorpangloss wrote: post #64
leetrout wrote: post #61

Earlier quoted context omitted.

> We currently support AWS but use terraform for deployment, which is pretty cloud agnostic. Nothing could be further from the truth.

You’re right but the kind of people who buy this service buy into the perception that Terraform is cloud agnostic, and perception is reality. Another POV is that the compliance companies sell the holistic social experience of compliance. The people for whom this matters need checkboxes and don’t mind paying for consulting disguised as a CSA. In fact they may even prefer it.

At the end of the day, whether its AWS S3, GCP Buckets, Azure Blob Storage, or EKS, AKS, GKE — there are services to serve as drop in replacements for their competitors. The principles of deployment will remain the same as it pertains to access and compute allocation, but obviously the resource definitions, and the definition syntax, is unique. We’re solely focused on building out our AWS support (a function of market pull), and plan to use the same architecture design for additional cloud providers when it comes time to make that jump.

Completely get where you’re coming from w.r.t. organizations looking to check a box. If we wanted to sell to those organizations, we would stop short of architecting their infrastructure and implementing best practices. A checkbox is never enough, and a point in time review can be easily gamed.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#77

Post by selinkocalar »

Sephr wrote: post #68
selinkocalar wrote: post #45

Earlier quoted context omitted.

Yes, you’re correct in your assertion that infrastructure policies are just one part of the puzzle. In conjunction with our preconfigured deployments, we provide customers a set of legal policies we’ve worked with former US Attorneys to closely align with the spirit of HIPAA enforcement. We’ve all seen the countless byteDance and Meta cookie data leakage headlines on insurance and healthcare portals, and provide cust…

> [we] provide customers with notice to remove trackers, or sign BAAs with user metrics companies where possible Do you provide any technical solutions to help your customers control these trackers in accordance with HIPAA and privacy laws, or do you refer your customers to third-party privacy solutions to accomplish this? You expressed disdain for "hitting checkboxes," yet your solutions to this specific problem app…

Good question, these trackers typically come in the form of developer installed pixels / trackers, making this situation a function of human choice. During onboarding, we conduct a supply chain vendor risk assessment, identify which vendors we can help facilitate a BAA agreement with, and which vendors (if any) need to be removed from a deployment. From there we provide the resources to initiate a communication channel with the associated vendor.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#79

Post by selinkocalar »

throwkjkbkljbk wrote: post #75
debarshri wrote: post #31

Earlier quoted context omitted.

Solutions like this wont work in large orgs that have lead to huge ACVs. Would be more happy if you prove me wrong.

No you're right for sure. Aptible is mentioned a few commends down, and is/was basically the same business (compliance focused hosting for small startups). Now Aptible has seemingly pivoted away from that focus and are now trying to compete in the PaaS space. There are a couple of obvious reasons here. 1. You're limiting your TAM to just healthcare startups. Why? 2. After not that long, it doesn't make financial sens…

We absolutely agree. HIPAA compliance for startups is only the beginning for us. We're rolling out SOC2 soon and then will use these as a foundation to moving upmarket.

Our end goal isn't to work with startups to automate compliance - we're using this as a launchpad to going upstream in the GRC space.

Re: Launch HN: Delve (YC W24) – HIPAA compliance as a service

#80

Post by selinkocalar »

FireBeyond wrote: post #72

As someone who has been in healthcare IT for maybe 10 years, comfortable with HIPAA HITECH, SAS70, etc., one thing I took a pause at was: > Yes! HIPAA auditors have reviewed Delve to ensure that we cover HIPAA requirements. To me, the word 'review' is doing a bit of heavy lifting. There's a lot of self-attestation in the HIPAA world, a lot of policies and processes - but to my understanding (and forgive me if it is f…

Glad you pointed these out!

Regarding your first point, we've partnered with auditors at Insight Assurance. We've worked with them to map our compliance workflow, infra setup, and controls list with their auditing controls list. This lets us ensure that our compliance tool meets the standards necessary for a HIPAA audit as well as general security best practices.

Regarding your second point, we've put our infrastructure configuration through multiple rounds of review with AWS architects that we are working with through YC, with an exited DevOps engineer/founder that we've hired onto our own team, and with our own technical background from MIT. Of course, we have no official attestation from AWS. We've done a lot of due diligence in battle-hardening our infra setup (one of our clients receives 3M+ postgres requests an hour, which we are able to support).

Post reply on HN