0
0

I built an open-source connector between MyChart and Claude (self.healthIT)

submitted by [deleted]

[deleted]

all 58 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]william_jack_leeson 16 points17 points  (17 children)

Let me get this straight, to set this up you have a setup that gets authenticator app codes configured to run from a server that the user sets up and also, logs into MyChart using the saved browser username/password automatically? Encrypting credentials, even at rest, along with automating the TOTP flow in this manner effectively removes the user's 2FA protections.

Also, you have a button to deploy this on your site that includes an Oauth activation via Gmail, so effectively a user would be tying their Gmail identity together with their MyChart username?

If so, you're in some pretty dicey territory, not even considering Epic's likely response to this repo and use. Have you compared their TOS or the TOS/AUP for the typical health system to what you built?

Have you paid attention to the recent spat of lawsuits associated with QHIN Participation by law-firms adjacent companies participating in medical record exchanges and the fallout from that?

Where are your TOU and AUP? What risk is the <= minute setup for the patient taking up?

You seem to imply the data isn't stored therefore you don't need to worry about HIPAA however it's going through your proxy for the express option???? Do you know what THAT implies related to HIPAA?

[–]audrikr 8 points9 points  (11 children)

If you look at the code it's even more insane. My jaw is on the floor.

[–]Snoo-29984 0 points1 point  (10 children)

Is the Github page still up?

[–]audrikr 0 points1 point  (8 children)

It is, it looks like the name changed: https://github.com/Fan-Pier-Labs/openrecord

[–]Snoo-29984 0 points1 point  (7 children)

Oh my god this is even worse than I thought it would be

Screaming crying throwing up

[–]thisisryanh 0 points1 point  (6 children)

A lawyer from Epic reached out and said i shouldn't include their Trademarked "MyChart" in the title of the project so i renamed it

[–]Snoo-29984 0 points1 point  (5 children)

do you really think i was reacting to the name change?

brother you are storing personal health info and passwords as plaintext

[–]thisisryanh 0 points1 point  (4 children)

not correct

[–]Snoo-29984 0 points1 point  (3 children)

Do you even understand the code? Probably not cause you got Claude to do it.

Here’s an example:

export type ProfileData = { name: string dob: string mrn: string pcp: string email?: string | null }

Seriously?

[–]thisisryanh 0 points1 point  (2 children)

This is going to be my last comment on this thread. There's a difference between storing data in a database and just piping it through the system. I'm piping it through the system, not storing it.

[–]thisisryanh 0 points1 point  (0 children)

yes

[–]superexpress_local 0 points1 point  (0 children)

Friendly correction: spate of lawsuits. A spat is a small argument.

[–]Classic_Scallion_207 0 points1 point  (3 children)

Opened an issue on the repo about HIPAA violations, got back "nuh-uh", issue closed, and he blocked me. Considering reporting to HHS... kinda concerned they'd shrug it off though...

[–]william_jack_leeson 0 points1 point  (2 children)

It's not a HIPAA violation if a patient decides to use a tech that's unsafe.  HIPAA applies to covered entities which they are not so HHS has no teeth here.

The reference to using a proxy was me thinking the proxy provider might not be ok with that since sometimes they might be logging PHI unknowingly.

So all up, imo this is not well done and a risky code base but it's likely legal, minus the original having references to Epic corp.  

Be careful out there!

[–]Classic_Scallion_207 0 points1 point  (1 child)

I feel like you could argue that exposing health data to an LLM inherently means you're giving any of said data to any non-company users (by way of user-generated model inputs being used to train a new model, and thus potentially leaked to others) without your knowledge and consent.

[–]william_jack_leeson 0 points1 point  (0 children)

Right but if you choose to do it as a consumer/patient, you are choosing to do it. Just like if you printed out your whole medical record and left it in a folder in the middle of a shopping mall with a sign saying "hey readme".

People are serving their records up to chatGPT today to get advise, look at their analytics about the amount of healthcare questions they get. The consumer choosing to do that is totally legal and fair. This just wraps that to a smaller degree since it's completing actions etc...

The issue with this repo, IMO, is that it doesn't necessarily tell anyone using it straight up what it's potential consequences are. I.e. it isn't clear about combining stored credentials and MFA bypass on a single device, clarity about how the credentials are encrypted, referencing the MyChart TOU where it isn't there place to enforce those and not understanding that each health system will have it's own TOU/AUP as well that you might be violating etc.... so a LOT is up to the consumer and it's not terribly clear. Like your LLM example...

They aren't a HIPAA covered entity, nor is ChatGPT, so again, they aren't required to follow HIPAA. If you download your records to google drive you're in the same boat, but with a company who understands the legal risks of someone using their software and who pays a lot of attention to security. This codebase isn't that so again, buyer (or it's free I guess so user??) beware.

[–]anonisland5 13 points14 points  (1 child)

DO NOT RETURN MY MEDICAL RECORDS NUMBER AS A STRING IN RESPONSE TO A QUERY FROM DISCORD

[–]thisisryanh 0 points1 point  (0 children)

What? We don't integrate with discord

[–]Rich-Athlete3627 12 points13 points  (0 children)

So… you have attempted to reverse engineer Epic’s MyChart internal APIs? 

I hope you understand how much Epic will not only hate this but also will go after you. I honestly would recommend taking this down and removing this post here. 

This opens you up to a host of legal issues beyond the host of legal issues others have already mentioned. 

[–]Fliegermaus 11 points12 points  (0 children)

Jesus Christ OP this is a massive risk to patient privacy. I recognize that you’re trying to build something helpful but healthcare is not the place for the move fast and break things tech mindset.

You say that you’re going to inform patients of the risks and benefits of using your connector, but quite frankly the benefits here are limited whereas you risk exposing essentially all of a patients PHI while compromising 2FA protections across potentially multiple accounts. That sort of risk is not worth the benefits a patient would get in return, especially with other offerings like EMMIE.

If you’re dead set on sticking with this project then I appreciate and acknowledge your dedication but you need to to sit down, read through the feedback here, and implement changes to your encryption schema, credential handling, and auth flows. You. Not Claude Code.

[–]robotics500 21 points22 points  (8 children)

nah. Epic already beat you to it with EMMIE. also, you're better off connecting your data using QHIN and TEFCA authorization. Mychart is hiding a TON of functionality and data from you.

[–]screenager7 -1 points0 points  (0 children)

It's usually the healthcare organization using MyChart that is hiding patient data and functionality, and TEFCA is also currently a per-organization, opt-in basis.

[–]audrikr 9 points10 points  (0 children)

Oh dear god why

[–]lcsulla87gmail 8 points9 points  (5 children)

I dont want to give them full access to my health records.

[–]thisisryanh -2 points-1 points  (4 children)

Then don't use it

[–]lcsulla87gmail 8 points9 points  (3 children)

Anyone using this risks their phi. How are you planning to mitigate that? What you are building would harm people.

[–]thisisryanh -2 points-1 points  (2 children)

I'm going to make it very clear to users on the risks + rewards before they sign up. Everything is encrypted at rest + double encrypted in the application layer before stored in the DB. No PII is stored (besides credentials, which have to be stored).

[–]tantrAMzAbhiyantA 0 points1 point  (0 children)

"your" (your stochastic parrot's) code says otherwise.

[–]RedDragon7913 8 points9 points  (1 child)

Has anyone pointed out to you how many HIPPAA violations this is? Legally you're putting yourself at risk here by doing this. On top of how much this is NOT a good solution to the problem here, but that's a different conversation that doesn't matter as much as "legally you're pointing a loaded gun at your own head" here

[–]Dissident-451 4 points5 points  (0 children)

I work for an EHR and this is a nightmare 

[–]xvillifyx 8 points9 points  (0 children)

Holy fuck this is vibecoded slop

You’re not handling encryption or creds properly whatsoever

There are other violations to phi protection than storage that you’re committing here

[–]endotoxin 7 points8 points  (0 children)

Outta curiosity, did you run this idea past a lawyer or HIPAA officer first? Or perhaps the Mass DPH?

[–]LookLong5496 6 points7 points  (3 children)

No one needs this and no one is going to pay you for it.

[–]thisisryanh 0 points1 point  (2 children)

I'm not asking for money

[–]LookLong5496 3 points4 points  (1 child)

I was a bit harsh. Sorry. So much AI related spam these days and it's almost always eventually accompanied by some type of call to action.

[–]thisisryanh 0 points1 point  (0 children)

All good no worries.

Its true.

[–][deleted]  (2 children)

[removed]

    [–]lightswitch2159 4 points5 points  (1 child)

    Anthropic does have a BAA.

    OP is almost certainly not using a qualified product, however.
    https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers

    [–]Dissident-451 4 points5 points  (3 children)

    You offer remote hosting and store passwords in plaintext? No problems there.

    [–]thisisryanh 0 points1 point  (2 children)

    We do not store passwords in plaintext. Credentials are encrypted

    [–]Hefty-Road5633 0 points1 point  (1 child)

    Source: Trust me

    [–]thisisryanh 0 points1 point  (0 children)

    The source code is on GitHub. You can check yourself

    [–]Teleguido 3 points4 points  (0 children)

    Gross.

    [–]chevyfan17 2 points3 points  (1 child)

    u/lawtechie u/tuxedojack

    Based on your experiences in Healthcare and data security related fields, how bad is an idea is this?

    [–]Immediate-Win-3043 0 points1 point  (0 children)

    If you wanna watch someone have a mental breakdown over this here you go.

    https://www.tumblr.com/daughter-of-sapph0/812474858995859456

    [–]Reasonable_Regular1 2 points3 points  (0 children)

    Exciting legal consequences ahead for you if this takes off even a little bit, and you deserve every one of them.