Disclaimer: I’m not an expert on HIPAA regulation or a lawyer so don’t take this as legal advice. There are likely to be errors in this guide so it’s worth doing your own research. If you find any errors please let me know at luke [dot] harries [at] me [dot] com or submit a pull request. It’s worth discussing your plans with a lawyer. If you can’t afford a lawyer then, until you can, ask a founder who has built a similar startup. It’s crucial to uncover the unknown unknowns early on.

This guide is for HealthTech startups who want to launch an MVP under HIPAA regulation. It’s the guide that I wish I had when setting up infrastructure for COVID-19 drive-through testing. I’ve compiled it from speaking to health lawyers, HealthTech founders, HIPAA experts, and reading too much regulation.

Summary

It’s possible to run a HIPAA compliant startup and launch an MVP in a few days at virtually no cost. The TL;DR version is: run your business through GSuite (sign the BAA first); leverage Saas apps to handle PHI and embed them into a static site; and use Aptible Comply to generate your policies and procedures.

Understanding HIPAA

HIPAA (Health Insurance Portability and Accountability Act) is a US federal law regulating entities which handle health data. By health data, I mean any protected health information (PHI) related to health insurance transactions. HIPAA has three main rules: privacy, security, and what to do if a “breach” occurs. If HIPAA applies to you, you will need to create and follow a set of internal policies and procedures to become HIPAA compliant. Otherwise, your company will be at risk of heavy penalties — $100 to $50,000 per violation.

HIPAA applies to two types of companies:

• Covered entities: your company takes part in health insurance transactions. For example, health insurers and health providers.
• Business associates: your company deals with PHI data for or from health insurance transactions. Your company will likely come in contact with PHI data by interacting with covered entities or other business associates.

As a rule of thumb, unless you are employing medical professionals or making health insurance transactions your startup will be a business associate under HIPAA.

Importantly, you don’t need to be directly interacting with a covered entity to be regulated under HIPAA as a business associate. For example, let’s say a hospital is using scheduling software running on AWS cloud hosting. The hospital handles insurance transactions and so they are the covered entity. The scheduling software will be handling patient intake information including their name and email (which are later used in a health insurance transaction) making them a business associate. AWS runs the servers and databases which the scheduling software uses and so AWS is also classified as a business associate.

A clear sign that you need to be HIPAA compliant is if a business partners asks you to sign a BAA and thus take the role of a business associate.

For more information on HIPAA I’d recommend Aptible’s HIPAA Compliance: Guide for Startups or TrueVault’s HIPAA compliance developer guide

Building your MVP

So, you have checked that you need to be HIPAA compliant but how do you make this happen quickly and cheaply while building an MVP?

The secret to building a HIPAA compliant MVP is the same as building an MVP in any other industry: write the minimum amount of code. But the pressure to write no/low amounts of code is far greater in HealthTech. Dealing with patient data means that each line of code you write, or system you develop, introduces further security and compliance risks.

Using HIPAA compliant Saas apps

The fastest way to be HIPAA compliant is to leverage HIPAA compliant Saas apps. For each Saas app you use, you will need to select the HIPAA compliant plan (normally the most expensive); sign their BAA; and properly configure it so no PHI information is public or sent over unsecured mediums e.g. from their email servers. If you can’t sign a BAA with the Saas app then it won’t be HIPAA compliant and so you can’t use it for PHI.

Internal operations

GSuite will be the core of your startup. When set up correctly, GSuite provides HIPAA compliant file storage (Google Drive), a collaborative database (Google Sheets), and external communication (Gmail). Google handles the security, audit logs, identity management, etc.

To set up HIPAA compliant GSuite, you’ll need to sign up for GSuite and sign their BAA. Enable Vault to retain data for auditing. Require multi-factor authentication.

Note: video calling with Google Hangouts is not HIPAA compliant.

If you plan on sending PHI over email (even Gmail), I’d recommend Paubox. Paubox will encrypt all outgoing messages and attachments. Finally, you’ll need to add a HIPAA email disclaimer.

To securely share PHI internally or with other companies (after you’ve signed a BAA with them) you should create a shared drive within Google Drive and add them as collaborators.

If you need to run custom code, you can reduce most security risks by running the code locally. Each evening (or however often you need to perform the task), download the relevant data from the Google Drive on to your work computer, run the script, and then upload the results to the Google Drive. Make sure your computer is encrypted and delete the PHI files afterward.

Building web apps

Instead of redirecting your customers to other Saas sites to handle the PHI, embed the Saas apps directly into your website.

For example, if you want a scheduling system integrated into your site: setup Acuity Scheduling and embed the booking form as an iFrame into your react web app. You can style CSS to make the booking form look native and deploy it as a static site from a Github repo using Netlify

Two Saas apps that might be useful are Acuity Scheduling for online scheduling and JotForm for form building. Make sure to configure them properly: be on the HIPAA plan; sign the BAA; remove all PHI sent in emails from their servers.

If you are looking to launch an iOS and Android app you could embed the Saas apps using a framework such as react native.

Building your own systems

Handling PHI with your own built systems adds significant complexity to be HIPAA compliant: audit-level application logging, centralized log collection, 3rd party security audits, vulnerability scanning, etc. This can be partially abstracted using Heroku Shield or Aptible Deploy. TrueVault has a detailed developer guide for HIPAA compliance and application development. But, if you can, try and build your MVP without PHI touching your servers as described above.

The Business Associate Agreement (BAA)

Each company you interact with where you share PHI will require you to sign a BAA. BAAs state that you agree to operate under HIPAA rules. For Saas apps such as GSuite or JotForm they will have a standard BAA to sign. If you are partnering with a Covered Entity, the BAA will often include how you inform them of breaches and that you will pay any fines resulting from your breaches.

Policies and procedures

To be HIPAA compliant you have to follow policies and procedures under HIPAA. There are loads of them. Luckily, as a startup with a small team and (hopefully) no/very little code, you can get this all set up in half a day. I’d highly recommend Aptible Comply. Comply generates the policies for your startup to follow. It helps you adhere to these policies by generating tickets based on time or events, for example, assigning HIPAA training to new employees. They have a free startup plan for up to 3 people if you send them an email.

This was originally published at https://harries.co/mvp-hipaa-compliance/

Hacker News (HN) is fantastic for keeping up to date with the latest advancements in startup and tech; submitted, ranked and commented on by people all over the world. However, with search, it becomes much more powerful.

Here’s what Hacker News Search it is great for:

1. Finding the best resources for learning a new technology

As engineers, we need to rapidly learn new technologies, languages, and skills. However, finding the best resources to learn from is hard. HN Search solves this.

For example, if you are wanting to learn about Natural Language Processing, or LSTMs just search for them to find the most relevant articles and useful tutorials.

2. Finding the top recent articles for a topic/company

HN is great for the top articles in the last 24 hours. But sometimes you want to see the top articles for the last week, last month or last year. HN Search Solves this and lets you filter by topic too.

For example, search to determine the progress of Quantum Computers, what the latest moves are by Amazon, or the most important research on CRISPR.

3. Getting crowdsourced opinions

It’s often useful to get opinions from people of varying backgrounds and locations. The comments section of HN is a great place for this. All you have to do is find the relevant article. This is where HN Search steps in.

For example, if you are considering a Ph.D. and are wanting to hear the pros and cons or are thinking of learning machine learning with Fast.ai course and are wanting to hear from people who have completed it.

General

• HackerNews Search [Search Engine] Incredibly useful for finding new resources
• Awesome list [List of Resources] Curated list of awesome lists

New to programming?

• Harvard CS50 [MOOC] If you want to learn how to build stuff (think apps, websites, startups. etc.) then use this to start your journey.
• Learn Python for DataScience [MOOC] If you want to learn Data Science (think research projects, extra job skills, etc.) then use this to start your journey.

New to machine learning?

If you don’t yet know how to program I’d definitely start with the courses mentioned above. Then choose one of the following:

• Fast.ai Deep Learning [MOOC] “Learn how to build state of the art models without needing graduate-level math — but also without dumbing anything down”. I would highly recommend this course, although they suggest having at least one year of python beforehand.
• Andrew Ng’s Machine Learning [MOOC] Arguably the most popular machine learning course online. It with the fundamentals, as opposed to the top-down approach of Fast.ai.

Programming

• Learn X in Y minutes [Guide] Summaries of programming languages.

Python

• Codecademy [Interactive tutorials] Start here
• Automate the boring stuff [Textbook] Useful for reference
• Beginner’s cheat sheets [Cheat sheet]

Computer Science

• Teach Yourself Computer Science [List of Resources] “All the resources you need to give yourself a world-class computer science education.”

Machine Learning

• A Visual Introduction to Machine Learning [Guide]
• Dive into machine learning [List of Resources]
• Siraj [Videos] Applied introduction to the different types of machine learning
• Scikit-learn choosing the right algorithm [Cheat sheet]
• Andrew Ng’s Machine Learning [MOOC] Arguably the most popular machine learning course online. It starts with the fundamentals, as opposed to the top-down approach of Fast.ai
• Fast.ai machine learning [MOOC]
• Machine learning mastery [Guides]
• Superintelligence: Paths, Dangers, Strategies by Nick Bostrom [Book]
• State of the art results for machine learning problems
• 100 Pandas puzzles [Guides]
• 100 NumPy exercises [Guides]
• Stanford machine learning cheatsheets [Cheat sheets] More theoretical than applied but very high quality

Maths for Machine Learning

• Review of Probability Theory [Cheat sheet]
• Linear Algebra review and reference [Cheat sheet]
• Mathematics for Machine Learning [Textbook]

Machine Learning in Medicine

• Review paper on deep learning, genomics, and precision medicine [Paper]
• Medical Data for Machine Learning [Datasets]
• Awesome Bioinformatics libraries and software [List] Tools for data pre-processing, handling and visualisation.

Deep Learning

• 3Blue1Brown [Videos] Visualisation of how neural networks work, gradient descent, backpropagation and some of the maths involved.
• Fast.ai Deep Learning [MOOC] “Learn how to build state of the art models without needing graduate-level math — but also without dumbing anything down”. I would highly recommend this course, although they suggest having at least one year of python beforehand.
• Andrew Ng’s Deep learning [MOOC]
• The Deep Learning Book by Ian Goodfellow [Textbook]
• Cheat sheets

Deep Reinforcement Learning

• Spinning Up as a Deep RL Researcher [Guide] “… educational resource produced by OpenAI that makes it easier to learn about deep reinforcement learning”
• Deep Reinforcement Learning: Pong from Pixels [Blog Post] Fantastic post by Karpathy guiding you from supervised learning to policy gradient methods.
• UCL Course of Reinforcement Learning by David Silver [Course] Videos and lecture notes on reinforcement learning from theory to practice. Works well with the textbook below.
• Reinforcement Learning: An introduction by Sutton and Barto [Textbook] The textbook on reinforcement learning.