Hacker News new | past | comments | ask | show | jobs | submit login

The point in question is whether HIPAA and other health privacy standards allow a provider to describe their architecture. They do (see: http://en.wikipedia.org/wiki/Health_Insurance_Portability_an...).

Whether a business chooses to talk about their setup depends on a variety factors including their business model. However, keeping such things private is often security through obscurity (http://en.wikipedia.org/wiki/Security_through_obscurity).




I think we had different understandings of the grandparent:

I don't think people building those systems are supposed to talk about them...

In a former job I worked on systems similar to what was described and my former employer would be very unhappy with me if I revealed so much as their hardware setup much less schema. I am not supposed to talk about such things, and there is an NDA that says so....

Whether it is legal for an authorized person from the company to discuss those matters is a separate matter.

Also, I must point out that this is not security through obscurity. Security through obscurity cannot be relied on, I agree. But in this case, it is a matter of preventing you competitors from knowing what you are doing.

You know your competitors can develop the same thing you did in time, but you want to make sure they have to spend that time rather than being "inspired by" reading over your source code or even stealing it entirely. In some competitive environments, even just knowing what your competitors are or are not capable of at that moment can be a huge advantage.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: