How to make Framework hosting HIPAA-compliant?

[jaanli]

Hi! We @onefact have been using Framework extensively since launch, and are preparing a demo for our presentation at the @duckdb conference:

as part of this demo, we need to display summary statistics of >20 individual patients’ electronic health records to remain in compliance with the federal law known as HIPAA.

however, we checked with the observable team and the platform is not compatible with HIPAA.

Would a solution like this one: https://github.com/taubyte/tau help fix this? Does anyone else have this issue? Any ideas? Happy to add you to our slack and do our best to contribute this!

Duckdb conference for whence we need this demo: https://duckdb.org/2024/08/15/duckcon5.html

Grateful for any help for our small nonprofit! It will go a long way toward helping doctors use our tools.

[mootari]

(I've edited the title to clarify that this is about the hosting of Framework projects.)

[jaanli]

Thank you so much @mootari !

[mootari]

My understanding of HIPAA compliance is only superficial, but I don't think that setting up your own hosting solution automatically makes you compliant. From what I've gathered HIPAA compliance is an entire framework of measures that need to be conducted regularly (and thus incur a certain cost).

I would probably research HIPAA compliant hosting providers for small businesses, since most solutions appear to be tailored towards enterprise customers.

[jaanli]

@mootari thanks for telling us! HIPAA compliance is not superficial :(

For example, at previous companies I've worked at like @google-deepmind and @google and @Phare-Health, HIPAA compliance was arduous and involved several de-identification measures of these 19 classes of protected health information (protected under the federal law):

https://www.ecfr.gov/current/title-45/part-164/section-164.514#p-164.514(b)(2)(i)

Is that helpful?

That is one example, and there are more.

Happy to connect you with anyone it would help for you to understand how vital HIPAA is for 20% of the GDP (specifically referring to our health care sector in the United States here, not sure about other countries, though CIOs/CFO procurement is affected in other countries by HHS & FDA federal laws like this :).

[mootari]

@jaanli I described the extent of my understanding of it as superficial, not HIPAA compliance itself.

[jaanli]

Ah understood my bad @mootari thank you for clarifying Fabian! Writing in a hurry :)

[mootari]

... Rereading your question, can you describe what parts you consider problematic / where the compliance comes in? If you're worried about the source data that is processed by your data loaders, rest assured that this is local only and never leaves your machine.

[jaanli]

Thank you! It is the programmatic guarantee of encryption at rest, in flight, in use - is this code open source somewhere for the hosted solution? Last time I checked with your sales team then Observable was * not * HIPAA-compliant in the least.

Appreciate any leads! If email is easier: [email protected].

[mootari]

You're planning to present aggregated patient data at a conference. Can I assume that the presented data is already in a state that will not violate patient confidentiality?

[jaanli]

No, that is not true. We work with researchallofus.org data which contains protected health information.

However, we have permission from their director to pre-train the LLMs I've built such as ClinicalBERT (https://arxiv.org/pdf/1904.05342, published under my maiden name :) on their genetic and health record data, and present summaries of queries with minimum 20 patients.

These queries are reperesented in SQL to guarantee (under the Apache 2.0 license) that we are compliant with both HIPAA and our data use agreement with the @NIHGOV team who is the custodian of this data.

[mootari]

I can't shake the feeling that we keep talking past each other. Please take your time to read my replies, or wait til you can make the time.

Please confirm that we're talking about two kinds of data:

• the source data, which you have been entrusted with, and which I understand to be confidential
• the summary data, which I understand to be the output of your data loaders; this summary data is not confidential and is what will be presented to attendees at the conference

Does that sound correct? If not, can you make it so the data returned by your data loaders is no longer considered confidential?

[jaanli]

I can't shake the feeling that we keep talking past each other. Please take your time to read my replies, or wait til you can make the time.

Thank you so much!! I am doing my best but we are a small nonprofit so understaffed - apologies. Doing my best to understand this complex set of federal laws so we avoid lawsuits from violations.

Please confirm that we're talking about two kinds of data:

• the source data, which you have been entrusted with, and which I understand to be confidential

Not quite - there is some source data in each category:

• source data that is confidential (such as individual-level whole genome sequences and electronic health records in the researchallofus.org national clinical data repository). This contains protected health information.

• there is other source data which is not confidential, such as the prices from 4000+ hospitals we published last year: https://data.payless.health/#hospital_price_transparency/ (published under CC-BY-SA 4.0)

• there can be client-side source data which is confidential and contains legally protected health information.

For example, a clinician dictating notes into our AI system for predicting risk of readmission to a hospital (https://arxiv.org/pdf/1904.05342) cannot legally entrust their data to our servers without a business associate agreement, service level agreements, etc that would make us liable for compliance with HIPAA.

These agreements would need to be negotiated with every one of the 4000+ hospitals in the United States alone.

Without such agreements, we cannot store the data that clinicians generate, but we can help them understand that a WebAssembly-based dashboard (such as this one in Framework: https://onefact.github.io/healthcare-data/) is indeed compliant with federal law.

An example use case:

Specifically, if a clinician took a screenshot and identified a payment amount for one patient and added their name/age/sex/ZIP code, that would be protected health information. If that clinician sent that annotated screenshot to us, we would have to delete it.

However, if that clinician keeps the screenshot on their encrypted computer, it's fine and we don't need to comply with HIPAA.

Another example use case:

A more complex scenario happens is if the clinician first uses a transcription system such as this one (https://github.com/ggerganov/whisper.cpp/tree/master/examples/whisper.wasm) and then feeds the transcript from a primary care preventative medicine visit to our AI (https://arxiv.org/pdf/1904.05342).

In this case, we can guarantee to the clinician that only they are receiving the results on their client (usually a web browser), and the protected health information in the transcribed clinical note is never sent to a third party.

• the summary data, which I understand to be the output of your data loaders; this summary data is not confidential and is what will be presented to attendees at the conference

That is correct!

Does that sound correct? If not, can you make it so the data returned by your data loaders is no longer considered confidential?

De-identification is very difficult, and Amazon, Google Cloud, and Azure each have their expensive de-identification APIs that attempt to create non-confidential clinical notes from clinical notes containing protected health information.

I hope this helps! I'm happy to dedicate several hours to this and write a hackmd.io document if it would make it easier, or make a screen recording with clinicians on our team to illustrate these use cases if it could help.

Grateful for your patience and help on behalf of @onefact!!

[mootari]

To summarize what I wrote in the other threads:

• No, simply hosting the files yourself does not make you HIPAA compliant.
• You can expect HIPAA compliance to only be offered on Enterprise plans regardless of the service provider (the same will apply to Observable).
• For the use case that you outlined (publishing data) you don't need HIPAA compliant hosting. Through Framework's dataloaders you can generate aggregated data files without exposing the underlying source data.

And when you deploy a project to Observable, only the built files in the configured output folder are uploaded (which is handled here).

[jaanli]

That is helpful, thank you! One confusion I have is that we need to publish Framework dashboards for individual-level datapoints for trusted third parties (like clinicians on our team).

Am I correct in understanding we would need to (1) register for an Enterprise plan or (2) self-host in order to remain HIPAA-compliant using the @observablehq Framework?

[CobusT]

Let me jump in here. @jaanli I would suggest emailing [email protected] so that we can set up a meeting to discuss your needs in more detail.
Based on your initial question (hosting summary statistics), my understanding is that your hosting provider would not need to be HIPAA compliant.
However, this new requirement (Framework sites for trusted 3rd parties with individual-level datapoints) does seem to require HIPAA compliance. For that, you would need to discuss signing a DPA with Observable and we can also discuss methods for how to support the multi-clinician requirement.