undefined | Better HN

0 pointsfreshpots3y ago0 comments

From their main page (https://www.nabla.com/), the mention HIPAA:

Secure and HIPAA-eligible

    Audio, transcripts, and notes are not stored by Nabla
    HIPAA-eligible and GDPR compliant
    SOC 2 and ISO 27001 certifications in progress

Digging deeper (https://www.nabla.com/blog/privacy-security/):

This data processing is done on Nabla's servers, which are powered by the HIPAA and GDPR compliant Google Cloud Platform (GCP), and on HIPAA-eligible LLM servers.

0 comments

JohnFen3y ago

What does "HIPAA-eligible" mean?

EDIT:

I was very curious about this and did a bit of research. The answer to it is squishy. It seems to be mostly a marketing term. The best definition I found was this:

"A service that is HIPAA eligible is one that is capable of being configured in a way that could meet HIPAA compliance requirements, but you have to know how to do it, it doesn’t happen ‘out of the box.’"

https://www.cleardata.com/articles/hipaa-eligible-hipaa-comp...

So it sounds great but doesn't actually mean that much.

SkyPuncher3y ago

"HIPAA-eligible" means they have no idea what they're doing in healthcare.

The second you said that in a pitch to executive leadership, they'd realize you have no idea how to operate in healthcare.

manv13y ago

What that really means is:

* they may be HIPAA-compliant (ie: they fulfill the requirements), * they haven't gone through a HIPAA-certification (no third-party cert), * they aren't using services that aren't HIPAA-certifiable

The latter point is important, because there are some services (ie: firebase) that apparently won't be HIPAA compliant. Some services are HIPAA-compliant if configured correctly. AWS has a list. I believe google does too.

There are a bunch of HIPAA guides out there.

So as a demo, it's not a big deal. But if they start selling this they need at least to be HIPAA-compliant with certification on the roadmap.

1 more reply

mraison3y ago

Hi everyone! We’re of course well aware of the importance of HIPAA for all organizations operating in the US. To clear up any confusion: HIPAA-eligible means in our case that we’re ready to sign BAAs.

meghan_rain3y ago

lmao literally a weasel word

dragonwriter3y ago

Either they are offering to sign a HIPAA BAA or they aren’t. If they aren’t, its HIPAA-radioactive. HIPAA-eligible for this kind of service is meaningless; when you have PHI going through a third party system, its BAA or GTFO.

j / k navigate · click thread line to collapse