News for hackers. Stuff that matters.

A comment on Google's harvest of medical data includes names and full details of millions. Parent comment

Re:Google's harvest of medical data includes names and full ... by tensor on Tuesday November 12, 2019 @03:25PM (#21517761)
Yes, if you have HIPPA you get routine audits to make sure you are obeying the law.
[ Parent | on HN ]
Re:Google's harvest of medical data includes names and full ... by marcinzm on Tuesday November 12, 2019 @04:03PM (#21518155)
No you don’t, there are fines if you are found in violation but no one is checking on an ongoing basis. Specific entities may privately pay for audits or do so as part of certifications (HiTrust, etc) but that’s not required.
[ Parent | on HN ]
Re:Google's harvest of medical data includes names and full ... by bduerst on Tuesday November 12, 2019 @07:45PM (#21519979)
The dept of HHS requires any organization with HIPAA business associate status to regularly undergo audits.

Can you fly under the radar and potentially get away with not doing it? Of course, anything is possible. Could a multibillion dollar internet organization beholden to shareholders and under public scrutiny get away with it? Not likely.

[ Parent | on HN ]
Re:Google's harvest of medical data includes names and full ... by marcinzm on Tuesday November 12, 2019 @08:48PM (#21520416)
>The dept of HHS requires any organization with HIPAA business associate status to regularly undergo audits.

Can you provide a link to this requirement? The HIPAA/HITECH laws provide no requirements for an external audit (and self-audits aren't actually audits) and the HHS, as far as I know, only does small sample random audits unless a complaint was made.

[ Parent | on HN ]