Show HN: HIPAA compliant file storage

https://news.ycombinator.com/item?id=7033188

by jason_wang • 13 years ago

52 36 13 years ago

news.ycombinator.com

We (TrueVault), released our HIPAA compliant file storage today. Our BLOB Store is not a cloud file backup service like Box or Dropbox but instead, it's meant to be integrated with healthcare mobile apps, web apps and wearable devices. During our beta period in December, early adopters are using the BLOB Store to store X-Rays, CT Scans, MRIs, PDFs, scanned medical records, images, and videos.

You can upload, update, delete, and download any binary file via our REST API.

We are also beta testing a browser-to-TrueVault direct file upload and download web form. If you would like to join the beta, please email us at beta@truevault.com

API: https://www.truevault.com/rest-api.html

Blob post about its release: https://www.truevault.com/blog/hipaa-compliant-file-storage.html

Love to get your feedback.

joshgel• 13 years ago

much needed service

quickpost• 13 years ago

Awesome work! I have a nascent project in the healthcare space and I will definitely consider using this for all HIPPA related issues.

One tidbit - will you have some kind of "HIPPA Compliant" image that can be placed on partner sites using your API? Sort of like the "Secured by VeriSign" graphic that shows up on eCommerce sites to give the end user more trust that their data is secure, etc.

jason_wang6• 13 years ago

@quickpost: We are on the same wavelength about the "Secured by TrueVault" badge :)

ceejayoz• 13 years ago

"Secured by VeriSign" style badges are pointless advertising for the vendor. I'd love to see an A/B test with them that isn't sponsored by the vendor - they all tout conversion with internal tests that could easily be biased. Given that I can just grab the image and slap it on any old website, they offer no benefits.

larubbio• 13 years ago

I thought the same thing as you and had the same reservations when a marketing exec asked me to put one on the purchase page for a startup I used to work for. I was shocked when the A/B test we ran showed a lift. I wish I had more details but this was about 5 years ago.

I think people just want some assurance, even if it isn't backed by anything they understand, that a shows them that a decision they really want to make is ok. Putting a shiny badge that says it is safe is enough to sway some people.

aptxkid• 13 years ago

BTW, Box is HIPPA compliant

magic5227• 13 years ago

and cheaper

jason_wang6• 13 years ago

Box is HIPAA compliant, but:

Box is cloud backup for files on your computer.

TrueVault is an application backend that mobile apps and web apps are built on top of.

We have customers switching from Box to TrueVault because 1) our API is specifically designed to be called from a mobile/app rather than targeted for file backup use cases and 2) Box has a user based pricing that doesn't make sense if you are building an app rather than backing up files.

res0nat0r• 13 years ago

AWS is also HIPPA compliant.

http://aws.amazon.com/compliance/

jameskilton• 13 years ago

If you read deeper into HIPAA and AWS, you'll find it really isn't. It's possible to create mostly-HIPAA-compliant infrastructures using AWS but that's a lot of work and you still don't have a lot of information that HIPAA often requests, like datacenter and server access logs.

jason_wang6• 13 years ago

jameskilton is correct. AWS and Firehost give you a "HIPAA Compliant-Ready" environment (Firehost's own marketing line). It's ready for you to implement your own encryption cluster, key management and rotation system, network security, software security, etc.

trey_swann4• 13 years ago

TrueVault does more and costs less than AWS. We also save you hundreds of dev hours.

The HIPAA Security Rule requires appropriate Administrative, Physical, and Technical Safeguards to ensure the confidentiality, integrity, and security of protected health information (PHI).

AWS will sign a BAA, but they only cover the Physical Safeguards (e.g. facility access controls, etc.). TrueVault handles both the Technical and Physical Safeguards.

With AWS you still need to build your own HIPAA compliant application stack. The technical requirements include: -encryption and decryption -key management -key rotation -access control -unique user identification -emergency access -automatic logoff -audit controls -mechanism to authenticate electronic PHI -person or entity authentication -transmission security -integrity controls

vonseel• 13 years ago

I've been working on a mobile application for doctors and healthcare teams the past few months. We are a startup and will be going into beta testing with real users near the end of Q1.

I was interested in your last post on HN, as I've found it nearly impossible to sift through the bureaucratic cruft of HIPAA, HITECH, HL7, and all the other standards. A blog post on the topic would be amazing -- "What does HIPAA-compliant mean?".

The main fear I have about using your service is trusting a brand-new company for hosting. What reassurances can you provide that relying on you for my infrastructure will not screw me over if something happens to your company?

jkresner• 13 years ago

This looks great!

sargun• 13 years ago

How is TrueVault better than AWS?

trey_swann4• 13 years ago

Our customers are typically deciding between using TrueVault or a HIPAA compliant hosting provider. The customer is facing a build vs. buy decision.

The HIPAA Security Rule requires appropriate Administrative, Physical, and Technical Safeguards to ensure the confidentiality, integrity, and security of protected health information (PHI). AWS, FireHost, and Rackspace are great! But, HIPAA compliant hosting providers like these only provide a HIPAA ready environment. They will sign a Business Associate Agreement (BAA), but they only handle the Physical Safeguards mandated by HIPAA. If you use a HIPAA compliant hosting provider you still have to spend months developing a HIPAA compliant application stack within that environment.

In contrast, TrueVault provides all client-side and server-side functionalities required by HIPAA, and works just like any other API service. The typical TrueVault integration takes days and saves months of development time.

Plus, if you want AWS to sign a BAA you need to use dedicated instances and each instance hour is 10% more than the standard fee. So your meter starts at $1,500/month if you want to become HIPAA compliant with AWS. FireHost starts at $1,115/month and you are charged a $250 premium for each HIPAA ready instance.

rpedela• 13 years ago

"In contrast, TrueVault provides all client-side and server-side functionalities required by HIPAA"

Maybe I am misunderstanding, but you seem to be saying that a customer's application is automatically HIPAA compliant by using TrueVault. I get that you take care of the HIPAA storage piece, but how do you make their entire application HIPAA compliant?

matthewmacleod• 13 years ago

I don't quite get the USP here. S3 is also HIPPA compliant, and costs < 10% as much.

interstitial• 13 years ago

Well, according to much of Branding/USP theory, focus is a good starting point for a USP. The other providers (S3, box, etc) may also be HIPPA, but this company is driving the point home -- we only do HIPPA. I have no idea if this is a strong enough differentiation, just pointing out it's not necessarily anti-USP. And price is never a factor in government-compliance and government contracts.

jason_wang6• 13 years ago

S3 is a great building block if you are building your own HIPAA compliant stack. But used alone, you will not be HIPAA compliant. HIPAA requires you to provide emergency data access, detailed audit logging and data integrity control.

me2718000• 13 years ago

HIPAA is actually a pretty fuzzy, nonspecific standard. As long as you take 'adequate' technical/physical/administrative safeguards you are basically fine.

Literally a sealed envelope (when dealing with paper documents) satisfies all three.

killnine• 13 years ago

Would you be so kind as to expand on 'adequate' safeguards that make 'basically fine'?

gamedna• 13 years ago

Per their site: "Example monthly cost:

If WebMD Answers was a TrueVault customer, their monthly charge would only be $1,604. Here's the breakdown: WebMD Answers has 5,036,000 questions, so that's 5,036,000 JSON documents stored . According to Alexa, they have 1,042,705 page views a month, so that's 1,042,705 requests. And presto, $504 + $1,100 = $1,604/mo."

To save money WebMD should store their json documents as compressed binary objects and get way more than 10k documents per $1.

jason_wang6• 13 years ago

That's absolutely okay with us.

Though the developers at WebMD team may not be very happy if every piece of data is stored in a compressed BLOB. For each record lookup, you'll have to retrieve the entire compressed binary object, decompress it, find the record you need from some kind of a data structure. And if you are updating a record, you'll have to do all that, plus send the compressed binary object back. Performance might be an issue :)

All kidding aside, our system is optimized for fast lookup of secure data. For a site as popular as WebMD, our JSON Store really is the way to go.

jhgg• 13 years ago

A company I work with are looking into using TrueVault's document store to keep PHI off of our servers, however TrueVault still does not fulfil the requirements of our application. More specifically multiple document get & document search.

Other than that, the team over at TrueVault is extremely friendly, reasonable and nice to work with.

trey_swann4• 13 years ago

Thank you for your kind words!

Search functionality will be released by the end of January.

peterjliu• 13 years ago

Seems like they're running out of an apartment unit:

TrueVault 801 Church St. #1328 Mountain View, CA 94041

trey_swann4• 13 years ago

Dell "Beginnings" http://youtu.be/Ja61fxmY77Q

tzs• 13 years ago

How does HIPAA compare to PCI? Is it easier or harder or about the same difficulty?

daigoba66• 13 years ago

The difference is that PCI DSS is an industry developed and maintained standard. HIPAA is a piece of legislation that created rules around privacy and security (and a lot of other things). There are some standards outlined in the rule. But there is no agency in place to perform validation or audits, and as such being "compliant" doesn't mean much outside of how much you trust the entity. But the penalties are very real, and very severe. Working for a small healthcare IT software company, we take HIPAA very seriously.

tptacek• 13 years ago

HIPAA is easier than PCI. PCI involves not only concrete technical controls, but also a for-profit bureaucracy.

Neither are particularly meaningful from the POV of software security.

health-techie2• 13 years ago

First things first, and this is more for the edification of those commenting, not the group posting, the correct spelling is:

H I P A A

The acronym is the "Health Information Portability and Accountability Act."

Again,

H I P A A

I can't stand how many people mis-spell it - it exemplifies the fact that really and truly, people don't care about the regulatory standard enough to really learn about it ...

Not to hijack the thread, but I'd love to hear people's opinion on this question:

Which type of data is more important, health data or financial data, and why?

I'll start, financial data is more important than health data. Why? Because we all use money at least 100+ times a day to get things done - outside of a doctor's visit health data is virtually worthless.

Outside of obtaining your soc number in a medical record, would you be more afraid if a person got your bank's routing number, or your insurance ID?

Your credit card number, or the fact that you have erectile disfunction?

mattfenwick• 13 years ago

An interesting read on this topic at http://www.ncbi.nlm.nih.gov/books/NBK9579/:

"When personally identifiable health information, for example, is disclosed to an employer, insurer, or family member, it can result in stigma, embarrassment, and discrimination. Thus, without some assurance of privacy, people may be reluctant to provide candid and complete disclosures of sensitive information even to their physicians. Ensuring privacy can promote more effective communication between physician and patient, which is essential for quality of care, enhanced autonomy, and preventing economic harm, embarrassment, and discrimination (Gostin, 2001; NBAC, 1999; Pritts, 2002)."

I disagree with "outside of a doctor's visit health data is virtually worthless" for the above reasons.

health-techie2• 13 years ago

Okay. Thanks for linking to that article. I concede health data isn't "worthless," but I'd like to get people's personal opinion on which scenario is scarier:

Target losing the credit card data of 40 million customers, or a dermatology office losing a USB drive: http://www.fiercehealthit.com/story/dermatology-practice-fir...

A malicious party getting access to my banking data I feel is more scary than knowing my co-workers are teasing me because of my erectile disfunction.

Disclosing important health data to a person's employer, insurer, law enforcement etc, is a health data stewardship and education problem, not a 256-bit secure socket layer, 1048-bit RSA key-encryption problem, IMHO.

Show HN: HIPAA compliant file storage

Related Stories