Comment by kentonv
2 months ago
The key is the fine-grained instances (gadgets).
E.g. if you're using a slide editor app, each slide deck you create is its own instance of the app, whose code can be independently modified.
The slide content and the code are kept together and sandboxed together.
Adding HIPPA data to the app is no different to adding it to the slide content. I suppose whether or not that is OK depends on a lot of things, but the same things apply to traditional PowerPoint. The fact that the code is modifiable doesn't change the situation, since those modifications are sandboxed and constrained to that one slide deck.
I hope there are no healthcare CEOs reading this and if there are, please, for the love of god, do not let your execs or providers use cloud platforms to create apps with HIPAA data in them unless your lawyer is really bored and you have cash to burn on all the fines and lawsuits. Also don't offload yet another responsibility (i.e software development) to the people trying to take care of patients.
You can self-host using workerd.
But I'm certainly not claiming that this alone is sufficient to comply with regulations. I have no idea.