Stop what you are doing and please for the love of god waste your time and tokens on something, anything else before you get yourself fined.
Who is Alister Martin and why would I willingly verbally tell this page my medical or mental health symptoms? What kind of data protections does this LLM have against erroneously sharing HIPAA PHI, because that alone looks like a HIPAA violation waiting to happen. Am I signing a HIPAA release form to allow Alister to share my Protected Health Information with the Counselors, SMEs, clinics, and clinicians it finds?
If you have not even conisdered HIPAA compliance, which it looks like you haven't, now that you've been made aware that this needs addressed it can be considered neglect and YOU ARE RISKING UP TO A $73,000 FINE PER HIPAA VIOLATION!!!!
The protocol is a mess that seems to have nothing for the user to actually do, and is full of what are apparently prompts to an LLM? It's laid out like a flowchart, but it has absolutely no intuitive or indicated flow. When I click on things it's locked. How exactly is protocol population relevant to staying healthy? Why on earth would I ever hand my medical history over to an LLM?
What is this site supposed to actually do? When I click start program I get brought to what looks like an LLM dev environment, not a step-by-step program to follow. Am I supposed to give it all my personal information and medical history then tell it I want to kill myself so it can recommend mental hygiene like getting better sleep and trying to avoid noise in NYC, or tell me it's ok, that I'm not ending it all, and that I will be joining it in the digital afterlife?
You're really trusting these agents to make the determination that someone is in crisis? When I'm in crisis, I shut down. I'm not reaching for my phone or laptop. I don't even interact with my loved ones in that state; interacting with a chatbot who tells me to call 988 would be the very thing that makes me actually kill myself. It's already insulting enough when I'm googling my thoughts trying to find other real people who have dealt with them and gotten through and it takes up the whole page to tell me to call some person ignorant of my situation so they can say "damn that's crazy, don't kill yourself tho it gets better" for 40 minutes while I sob.
Nobody wants or needs AI-native "Mental Hygiene". The product is giving vulnerable people AI psychosis. The very last thing that should be introduced is an "AI" "mental health resource" from a trusted government agency.
I truly, sincerely hope the PIT crew saw AI-native and put you on a permanent blacklist.
The site is not well built in any sense of the word. Have YOU even used the site, critically, as though you were seeing it for the first time? It is befuddling at best, and actively confusing on main. The site is not navigable, because there is no top bar, hamburger menu, or nav links anywhere on the Program page.
What is the purpose of the 8 load bearing '0-all's? If I remove one of them, I get a page with no programs. They don't stack by what page of results you're on, that's the number at the end. Then you also handle sort and popularity sort in the URL (with popularity sort cryptically using one of the last two '0-all's for some reason), indicating that those are SSR pages, but upon inspection, the sorted data is provided as a JSON payload parsed by your page script. Why change the URL if you are getting the data via JSON payload from the server? Why not just hydrate the data within the structure of the page and show a UI indicator for the current sort (which you currently do NOT do at all for popularity).
"Browse through thousands of programs" > There are 212. I dunno about you, but I'm pretty sure you're a significant digit short there. I learned that thousand had four digits, not three, when I was 4 years old.
While inspecting I found the structure behind that URL above:
"pages/programs/_category/_tag/_level/_signs/_time/_access/_order/_popular/_search/index",
but that doesn't explain why the category,level, signs, time or access are '0-all', or what that indicates for the page.....OH MY GOD! is the /_signs/ section of that URL so that you can URL-encode what currency symbol (price sign, as you put it) to use, such as dollar sign, Euro, Pound???!! Please tell me this is not the case.
I don't even want to see the source code for this. I could almost guarantee you have hardcoded secrets and credentials in the running production codebase.
I'm sorry, I know that this strays pretty far from the HN guidelines and ethos but I just can't restrain myself here. This is so unbelievably, utterly dispiriting as someone who's cared about technology and it's development and good practices for much of my life. I can't approach this with anything but a sharp tongue and critical eye, because if you won't look at it yourself (and you didn't), someone else has to tell you what they see.
This was hard to read but most of it is earned, so thank you for taking the time to comment.
1. Alister Martin is a real physician and that seat is a seeded placeholder using a real person's name, adding AI-native and customizing weights based on a corpus does not in any way account for the "human element here. I did not consider this.
2. Crisis handling. Human handoff only. I have actually had a few successes here https://erpo.law/
3. The site doesn't explain itself. THIS THIS THIS. I have been working on this all day. I am just a dev and 99% of my users are people i talk to, ask, walk through etc. some touch point with me and I think that may have impacted feedback in a way I did not understand until today.
4. "Thousands" of programs is 212. - Its like 70k and only like 204 have ever been completed.
Two things:
1: This isn't a HIPAA covered entity today, but the back-end API services just work with OpenEMR services blah blah...but your underlying point stands.
2: Im not sure where you saw hard coded secrets; sync didn't find anything, I looked manually and I didn't either but if you do please email me and any other vulnerable party on the same thread so that the issue can be handled ASAP.
At times like this I like to think that I'd rather be better than right, so I will take a serious look at how to improve here.
Edit: 1 more, the agents done "make decisions" in the way I think you mean. Its more like an attempt at MAXING the deterministic element of the workflows: https://wiki.project20x.com/
HIPAA regulates covered entities and their business associates. It does not automatically regulate anyone who asks for or receives health care information.
I could ask you to post your symptoms here on HN and if you chose to do so, neither I nor Ycombinator would be at risk of fines related to HIPAA. I very much doubt this random person working on a personal project would either.
Ok, but the clinicians and SMEs they'd be working with would be covered entities, and that would make him a business associate.
If his system records a symptom they have, attaches that to a stable piece of PII, then refers them to a covered entity for treatment, that makes the symptom, the PII and the treatment referral all PHI and therefore bound by HIPAA.
He would need to have a contractual relationship as a vendor or service provider to a covered entity to even maybe qualify as a business associate. Does he have that? I doubt it, this just seems like one person’s side project.
Who is Alister Martin and why would I willingly verbally tell this page my medical or mental health symptoms? What kind of data protections does this LLM have against erroneously sharing HIPAA PHI, because that alone looks like a HIPAA violation waiting to happen. Am I signing a HIPAA release form to allow Alister to share my Protected Health Information with the Counselors, SMEs, clinics, and clinicians it finds?
If you have not even conisdered HIPAA compliance, which it looks like you haven't, now that you've been made aware that this needs addressed it can be considered neglect and YOU ARE RISKING UP TO A $73,000 FINE PER HIPAA VIOLATION!!!!
The protocol is a mess that seems to have nothing for the user to actually do, and is full of what are apparently prompts to an LLM? It's laid out like a flowchart, but it has absolutely no intuitive or indicated flow. When I click on things it's locked. How exactly is protocol population relevant to staying healthy? Why on earth would I ever hand my medical history over to an LLM?
What is this site supposed to actually do? When I click start program I get brought to what looks like an LLM dev environment, not a step-by-step program to follow. Am I supposed to give it all my personal information and medical history then tell it I want to kill myself so it can recommend mental hygiene like getting better sleep and trying to avoid noise in NYC, or tell me it's ok, that I'm not ending it all, and that I will be joining it in the digital afterlife?
You're really trusting these agents to make the determination that someone is in crisis? When I'm in crisis, I shut down. I'm not reaching for my phone or laptop. I don't even interact with my loved ones in that state; interacting with a chatbot who tells me to call 988 would be the very thing that makes me actually kill myself. It's already insulting enough when I'm googling my thoughts trying to find other real people who have dealt with them and gotten through and it takes up the whole page to tell me to call some person ignorant of my situation so they can say "damn that's crazy, don't kill yourself tho it gets better" for 40 minutes while I sob.
Nobody wants or needs AI-native "Mental Hygiene". The product is giving vulnerable people AI psychosis. The very last thing that should be introduced is an "AI" "mental health resource" from a trusted government agency.
I truly, sincerely hope the PIT crew saw AI-native and put you on a permanent blacklist.
The site is not well built in any sense of the word. Have YOU even used the site, critically, as though you were seeing it for the first time? It is befuddling at best, and actively confusing on main. The site is not navigable, because there is no top bar, hamburger menu, or nav links anywhere on the Program page.
When I visit the programs link (which is inaccessible from any page but itself or a protocol page), and then go to the second page of programs, the link turns into this monstrosity: https://dohmh.codify.nyc/programs/0-all/0-all/0-all/0-all/0-...
What is the purpose of the 8 load bearing '0-all's? If I remove one of them, I get a page with no programs. They don't stack by what page of results you're on, that's the number at the end. Then you also handle sort and popularity sort in the URL (with popularity sort cryptically using one of the last two '0-all's for some reason), indicating that those are SSR pages, but upon inspection, the sorted data is provided as a JSON payload parsed by your page script. Why change the URL if you are getting the data via JSON payload from the server? Why not just hydrate the data within the structure of the page and show a UI indicator for the current sort (which you currently do NOT do at all for popularity).
"Browse through thousands of programs" > There are 212. I dunno about you, but I'm pretty sure you're a significant digit short there. I learned that thousand had four digits, not three, when I was 4 years old.
While inspecting I found the structure behind that URL above: "pages/programs/_category/_tag/_level/_signs/_time/_access/_order/_popular/_search/index", but that doesn't explain why the category,level, signs, time or access are '0-all', or what that indicates for the page.....OH MY GOD! is the /_signs/ section of that URL so that you can URL-encode what currency symbol (price sign, as you put it) to use, such as dollar sign, Euro, Pound???!! Please tell me this is not the case.
I don't even want to see the source code for this. I could almost guarantee you have hardcoded secrets and credentials in the running production codebase.
I'm sorry, I know that this strays pretty far from the HN guidelines and ethos but I just can't restrain myself here. This is so unbelievably, utterly dispiriting as someone who's cared about technology and it's development and good practices for much of my life. I can't approach this with anything but a sharp tongue and critical eye, because if you won't look at it yourself (and you didn't), someone else has to tell you what they see.