Nothing is safe sadly, HIPAA does almost nothing, in reality very few companies actually get the full fat $1000 per patient fine. Even the regulation itself is now hilariously outdated, "encrypted at rest and transit" is absolutely the lowest bar for security.

There are way too many fast and loose players in the mental health space, they do not care to actually have security. They do not have separate roles for security and engineering.

These startups only have to pretend to have security to appease their VCs. In Series B they MAY get a small security audit, but they already lie on their SOC2 or ISO27000... so whats some more lies?

The idea of having a rigorous process that ensures security is completely unacceptable if it adds any time to market.

This is why we see numerous hacks in the health tech space.

hipaa is a joke

I wonder when things will progress to the point where you could run a LLM that would do a good enough impression of a therapist on a 4090. I honestly think the only way I could trust something like this is if it was running on my own hardware, or a private cloud instance.

"I expect they are deidentifying under safe harbor and reselling as much as possible."

You've hit the nail on the head. A key excerpt from Jane.app's privacy policy highlights the potential risks:

"Suppliers and Service Providers. In order to operate our business and provide the Services to our Subscribers and their users, we may need to share a limited amount of personal information, including Patient Data, with our third-party suppliers and service providers." [1]

Currently, I'm attempting to remove my clinical data from Jane.app's servers, but I don't have high hopes for success. Many if not most of these smaller psychology and therapy groups rely on these platforms to store patient data. It is infuriating to me that the moment we disclose the most intimate details of our lives, they become permanent record.

"Removing Data from Jane. Practitioners offering health and medical services are under legal obligation to retain health or medical information that was collected during the course of treatment. It is their responsibility, in collaboration with the Jane Subscriber (clinic owner), to maintain these records, and in many cases, they are simply not allowed, under law, to delete certain records that they created, and they must retain records for a number of years, sometimes 10 years or more." [2]

Your secrets are not safe.

[1] https://jane.app/legal/privacy-policy [2] https://jane.app/guide/privacy-and-security/protecting-patie...