Show HN: Kate's App

> the rest are laughing at them on the way to the bank.

My understanding is that HIPAA is intended to stop providers from colluding against the patient, not to stop providers or middlemen from enriching themselves with our data.

Forget about anonymous data; sometimes PII is not sold, it's just given away by staff who don't know better. See my comment here from my own experience: https://news.ycombinator.com/item?id=17183682

HIPAA applies to covered entities, and this app may not be considered a covered entity (the closest they come is a clearinghouse and they probably do not fit the definition), but HIPAA has rules concerning how covered entities deal with business associates.

Kate's App would almost certainly fall under the definition of a business associate, and no health care provider should be entering protected information into the app without entering into an official agreement that the data will be protected according to HIPAA rules.

So technically Kate's App isn't doing anything illegal, but any health care provider entering info into this app would be. To fix the situation, Kate's App needs to certify that their app is compliant and provide an official agreement for providers. Otherwise healthcare providers should stay away, and this app would only be useful for friends and family members.

(I am not a lawyer, but I have analyzed health care data and it's cumbersome to deal with, especially if you are transmitting over a network). https://www.hhs.gov/hipaa/for-professionals/covered-entities...

I can't provide legal advice here; sorry. But I will say that there is a pretty big difference between hosting arbitrary customer-provided data where the customer can enter either kitchen recipes or medical data at their choosing, and stating that your service is intended to store PHI and attracting such information as a result.

I like boldcontacts. It wouldn't have been useful for my daughter, but it would have been useful for my grandmother.

I'm not a lawyer so I can give a little bit of legal advice, but... yeah get a lawyer.

Anybody who is a healthcare provider, anybody who gets paid to do anything that smells even a little bit like health care shouldn't touch this with a ten foot pole. They shouldn't look at it or touch it or think about it very intensely.

If you don't want to be in violation, don't receive medical information, don't store it, don't advertise that you handle it in any way.

Good advice:

- don't do anything at all that suggests that you will handle anything that even slightly hints it is storing, transmitting, or in any way touching healthcare information without being HIPAA compliant.

- especially don't do this as a side project, have a corporate structure with a very solid liability shield and don't do anything to pierce the veil

- do you want to avoid a 5,6, or 7 digit liability? Do everything you can to appear to be trying in good faith to follow the law and comply with regulations. Do things. Keep records of doing those things.

- even if you're _not_ required to, look up and follow the regulations, better yet, actually be HIPAA compliant even if it's not required. Many of these things you should be doing anyway even in very different fields.

- for God's sake get a lawyer and don't ask for advice on the Internet. Pay for the time for someone to sign off on what you do and whether or not you're inside the law

> people probably already having a lot of tools that they use and prefer. Another tool adds to their work load.

Further, a lot of providers are very strict about what tools their organization is allowed to use. In the past I’ve tried to get providers to look at a personal web page where I’d had a medical history and links to imaging data, and they weren’t allowed to access it via policy.

(I then brought 10 disks of imaging on a thumb drive - but they wouldn’t take that either. So I re-burned them onto physical media, and they were ok with importing that.)

I do understand why those policies are necessary, and in the end I learned their systems and limitations. It’s actually been an ok experience.

IANAL either but if I were you, I’d start here: https://www.vanta.com/products/hipaa or look for competitors.

And perhaps look at Stripe Atlas for getting my corporate ducks in a row to start with. https://stripe.com/atlas

Wading into that to get oriented, you would then be better equipped to have at least a baseline. A corporate attorney would be the next step to verify what you’re doing.

Minnestar.org hosts networking events that may be useful for finding people in the intersection of tech, healthcare, and law. Attend and get some face time to find people who may want to help. Lots of corporate centers in Minneapolis (assuming you’re in or near the twin cities), including healthcare. Depending on financial considerations, you may be able to find on ramps to grants, investors, or donors to fund compliance. Not sure on that though, but it’s possible.

Good luck!

While I agree that they probably aren't, their intended customer base is.

And even so, nothing precludes people from pursuing civil damages if there's a data breach - this is far more likely with sensitive data coming from a medical provider to a third party.

And as has been hinted at, the lack of professional presentation is going to hurt a lot, and people will immediately ask "can I trust this platform with any of my information?"

> Kate's App is a tool created to support medical caregivers and the people they care for

Seems like it is intended to be used by covered entities. But it does depend a bit on what "medical caregiver" is intended to mean.

That's not for any of us to determine here. A lawyer can answer that.

No.

Complete lack of legal compliance in the area that they are operating; the style of the name.

The issue of my employer is an example of real world consequences when a novice builds a product without understanding the rules they need to follow.

Unfortunately, there is a cohort of people in the startup scene, and who also participate in Hacker News, who don't like to hear negative feedback even when there are very clear consequences that that feedback is trying to address. Don't be one of those people, especially around issues of legal compliance.

From the blurb at the top: “ The app is 95% complete, […] I intend to clean up the rest of it, and go GA within a few weeks. ”

Assuming the last 5% is going to just take a few weeks is naive from a development point of view. Everyone learns this the hard way, so I don’t mean it as a dig.

They don't know, it's a total guess. That's why they hedge with phrases like "smell" and "if your goal..."

Uh, this is appears to be an application that collects data that is regulated in most legal jurisdictions, lacks a published terms of use, doesn't have a published privacy policy, and at first glance is missing rudimentary security controls related to TLS and content security.

The sparse documentation makes claims about privacy and security, but there is no evidence to back those claims.

I had the strong urge to scroll down that page to see if there's anything more to this site: who made it, legalese, etc, but no. While it claims data safety and privacy...

Yeah, that smells amateurish. Maybe OP can code well, maybe they have domain knowledge in healthcare, but damn, definitely utterly clueless in the legal area.

Telltale signs of application immaturity like using ids as urls

https://katesapp.org/patients/41

As much as folks in the software world believe in complete software development freedom, you can't just build whatever you want and release it. Laws exist that regulate what you can release as much as folks might dislike it. Health apps are just one example.

The problem is that OP literally mentions "medical caregiver" as distinct from "families" which can be interpreted to mean someone that operates as covered entity. That alone puts OP under the risk of being sued and being punished with a very large fine. All a user needs to do is put their data there, share the info with their care assistant who works for a health company. Once that happens, OP is breaking the law.

EDIT: Developer included this in a summary:

"Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and stays in the family."

Insofar as no providers or non-family use this, developer may have a point: my comment's covered-entity reasoning can be disregarded.

---

> Anyone who is willing to trust a random developer with their information can do so afaict.

No, not "anyone" in a multi-party app when "someone" is regulated.

This reasoning (a patient can choose to disclose) doesn't apply here, as the app expects providers to info-share new info, ongoing.

The providers are regulated, they have to keep records, and their sides of their tools have to be covered.

That said, even some U.S. national insurance companies bury a clause in their agreement where, to your point, the patient agrees to sort of declassify their info such that it's (the insurer company's theory goes) no longer considered HIPAA and the insurance company can go bananas with it (e.g., sell it to drug companies).

I had lawyers look into this on behalf of our firm benefits, and we challenged that clause. The national insurance company everyone has heard of instantly gave us a new employee insurance agreement without that clause, which suggests to me they knew it was dicey. (Imagine pinging Google and them dropping a clause from their TOS "just for you". That would only happen if they knew it didn't have legs.)

But, dicey or not, it suggests a path to try if you want to attempt this!

EDIT: Developer included this in a summary:

"Comments on HIPAA: I'm 99% sure this does not apply, since the site is for patients and their families, and no doctors, clinics, hospitals, or insurance companies are involved. All information comes from the family, and stays in the family."

Insofar as no providers or non-family use this, developer may have a point: my comment's covered-entity reasoning can be disregarded.

---

Not saying don't do YouTube, there's a persona who wants to learn from being talked to and shown.

But there's a less online (socially noisy) persona who prefers to read, see, and take in information far faster than a video. So don't skip the screenshots!

PS. I participated in the first patient centered groupware app 15 years ago, sold to the provider networks, so all providers a patient is ping-ponged to can interact as if a virtual team with the patient.

Your idea is viable, and giant hospital networks will buy it. But the top comment on this thread is likely dead right. You likely need to be HIPAA compliant for the providers to participate, regardless whether you sold the app to the patient or to the providers. Because unlike a personal notes app, your entire premise is info sharing among parties.

There is possibly a model for this that is technically outside HIPAA, but what you're showing / saying doesn't sound like it's navigated that.

Even if you use that potentially compliant model, it's then highly unlikely the providers will play ball, as then they'd have to be running as many apps as they have patients and they are too busy and already have to know too many systems. Even if they felt like setting a precedent of installing whatever apps patients ask them to use (they don't), the last thing they want is yet another place to redundantly key in information/communications. (They are required to have a record.) To get around that, you'd have to integrate with what they have, and boom, HIPAA again.

Does that work if you have multiple caregivers? Even seeing a doctor, and then getting a scan can involve multiple entities.

Not really. MyChart (which is provided by Epic) is a way for doctors and clinics to communicate with patients. Although you could give you doctor access to your information on Kate's App, that's not the purpose, and they probably don't want it.

I could understand epic since I think that's mainly for doctors but don't most hospital systems use MyChart or similar portals nowadays to let patients access access their appointments/payment/lab results/doctor notes/etc

> app developer having a change of heart

Yes. Two features high on my list of todos: 1) download all your data; 2) delete all data from the site.

The second is a bit more complicated, since multiple family members may have access to the same data, and may have different opinions on deleting it. I'll work it out.

Otherwise, you have only my integrity. I'm not looking to sell it, but I would love to hand this over to someone with more resources and bigger pockets. If I ever do, I would want those reassurances from them first, and I would definitely give all users fair warning, so they can pull out if they don't have the same confidence I do.

Thank you for these recommendations. I'll check out all of them.

Using Matrix+CRDTs for this is a pretty cool idea! It'd take a rewrite of this app, but you could let arbitrary Matrix chat server host the entire data store, getting rid of a lot of the data security risks (as long as you make sure your e2ee approach isn't too eager to share keys).

Then again, doing things this way might make data deletion and other privacy related issues quite difficult to achieve, especially if said Matrix servers are federated.

I am interested in local-first and security. I'll get in touch.

Go to that page then click the header link. It goes to https://katesapp.org/KatesApp/.

edit: not a relative link, but a 404 regardless

My understanding is that it keeps everyone connected. Like, you as a family member may be a caregiver or you may have a nurse or someone else as a caregiver and it can help keep family, caregiver, the person being cared for all in the know on what is happening.

So my first professional programming job was at a place where people described themselves as "C# developers" instead of software engineers. The team was run by a guy who had built his entire career out of teaching people a very dogmatic, .NET-specific flavor of MVP that he'd learned from a Learning Tree course without understanding any of its theoretical underpinnings. He augmented his One True Design by looking up ASP .NET hacks and tricks on StackOverflow, implementing them, then copying the source code for each project that he worked on to a USB key so that he could reference his handiwork at later jobs. Because this was a step above people writing unintelligible 3000-line classes he was hailed as a minor hero by management. His teachings created a professional quasi-religion where he was the Pope and his USB key full of copy-pasted jQuery selectors and Linq statements was the Bible.

In this hallowed religion one of the most fundamental rules was that every domain object had to have both an integer identifier ("ID") and a UUID ("GUID", because Windows). When I asked why we didn't simply use one or the other I was told that we had to have an ID because we "need a primary key" and a GUID because "we can't put an ID in the URL because then you can go to another record by changing it!" It didn't matter that we performed permissions checks on these routes because _security_. As I learned more about data modeling and relational databases I periodically questioned this (in retrospect we should have just used UUIDs as the PK because we had no good performance or design reasons to have both) but never got a good answer. This religion didn't tolerate heretical nonsense - GUIDs are for URLs because of hackers.

No idea if that's what's going on here but it reminded me of it.

https://portswigger.net/web-security/access-control/idor

It's not, by itself, deadly but it does lower the safeguards against ACL slip-ups, which could easily exfiltrate the entire customer base

Maybe fear mongering is overstating but...

Speaking to a lawyer is not the first step when building something in this domain (unless you already have someone bankrolling you).

In this case there's an app that this guy built for families to use. It's obviously in it's infancy. The helpful advice here would be about posting that this is in beta or maybe reading the HIPAA guidelines and ensuring that he's adhering to those guidelines where applicable. Focus on tightening up security. What's his plan to ensure that data in encrypted in transit and at rest? What kind of monitoring will the app have? Does he need to be thinking about intrusion detection? Will he need to enforce 2FA?

Does he need to stop everything and start speaking to lawyers? Probably not.

No, but I guess a product like this should be built in a way that the company doesn't have access to unencrypted data in the first place.

It might be easier to launch internationally first. Many places on the planet put good will in healthcare as more important than the almighty dollar. I have dealt with lawyers a number of times. Costs can spiral out of control very quickly, so take time to think over how much you are willing to spend and what your end goals are.

Yeah; self-hosted and open source I would be more open to it. This is just kinda sketchy.

I look at my page on mobiles all the time. The lack of margins really pisses me off.

A business associate to who? The user?

I was too.

https://www.hhs.gov/hipaa/for-professionals/covered-entities...