News for hackers. Stuff that matters.

A comment on Google's harvest of medical data includes names and full details of millions. Parent comment

Re:Google's harvest of medical data includes names and full ... by bduerst on Tuesday November 12, 2019 @07:45PM (#21519979)
The dept of HHS requires any organization with HIPAA business associate status to regularly undergo audits.

Can you fly under the radar and potentially get away with not doing it? Of course, anything is possible. Could a multibillion dollar internet organization beholden to shareholders and under public scrutiny get away with it? Not likely.

[ Parent | on HN ]
Re:Google's harvest of medical data includes names and full ... by marcinzm on Tuesday November 12, 2019 @08:48PM (#21520416)
>The dept of HHS requires any organization with HIPAA business associate status to regularly undergo audits.

Can you provide a link to this requirement? The HIPAA/HITECH laws provide no requirements for an external audit (and self-audits aren't actually audits) and the HHS, as far as I know, only does small sample random audits unless a complaint was made.

[ Parent | on HN ]