Hacker News new | ask | show | jobs
by rectang 1217 days ago
Is Copilot HIPAA compliant? It sends data to the cloud, so if you paste PHI…
3 comments

Not an answer to your overall question of compliance, but to the specific point:

> Copilot for Business does not retain any telemetry or Code Snippets Data.

https://docs.github.com/en/copilot/configuring-github-copilo...

The key word being "retain".

It's probably still sent to their servers.

And if that page changes without notifying you?

... Unless they are selling the compliance as a feature, be careful.

As long as it's part of the agreement, they would need to at least notify you if they're planning to change that.
Source: Ex Hospital IT.

I wouldn't risk it. It is too easy to write the wrong prompts and leak PHI.

ChatGPT:

"Write me a parser for this HL7 message..."

Copilot:

"Using this example message please write a parser for it..."

Yeah... If it was compliant, people would write those in a heartbeat.

Unless sold as HIPAA compliant, and the conditions of use for that compliance are known... don't trust it, for SAAS.

This is stuff covered in your yearly HIPAA briefing folks.

Realizing that many people still fundamentally misunderstand HIPAA and PHI:

1. First, you really only need to worry about the specifics of HIPAA if you are a "covered entity" under the law (primarily a hospital or other healthcare provider, or a health insurer), or if you have signed a BAA with another company (more on that below). There are all sorts of misunderstandings that you can't, for example, say something like "Jane couldn't make the meeting because she's out with the flu" at a company - that's not how it works. Unless you're a covered entity, you're under no obligation to keep PHI private under HIPAA.

2. If you do work at a HIPAA covered entity, it usually is made explicitly clear where patient data is or is not allowed. Even if GitHub Copilot were "HIPAA Compliant", unless they signed a HIPAA BAA (business associate agreement) with your company, it's still not OK to send them any PHI.

Point being, there are plenty of reasons to be worried about customer privacy and data security, but people like to bring up HIPAA rules in lots of situations where they simply don't apply.

Why on earth would you ever put any PHI information in source control?
I would not. I avoid pasting PHI into source controlled files altogether.