hipaa readiness audit

The problem

Developers often assume their stack is HIPAA compliant because they use AWS or Bitlocker. They lack a concrete map of how their specific code violates the HIPAA Security Rule or which vendors require a BAA.

What it does

• Scans codebases for ePHI-handling defects and maps them to specific HIPAA Security Rule citations.
• Identifies third-party vendors and AI providers that require a Business Associate Agreement (BAA).
• Finds missing audit controls, including failures to log record access (reads) rather than just writes.
• Detects ePHI leakage into client-side analytics, session replays, and unscrubbed error trackers.
• Generates severity-rated findings structured for OCR investigators or hospital security reviews.

Why this beats prompting it yourself

Generic LLM prompts often confuse proposed 2025 rules with current law or treat addressable requirements as optional. This skill uses a strict reference snapshot to ensure citations are accurate and distinguishes between code-level safeguards and organizational policies.

Use cases

• Preparing for a hospital CISO security review or vendor questionnaire.
• Auditing a healthtech repo to identify PHI exposure before a production launch.
• Generating evidence to feed an official 164.308(a)(1) risk analysis.
• Mapping AI usage to identify which LLM flows must stop due to missing BAAs.

Known limitations

Cannot verify physical safeguards (facility access) or administrative policies (employee training). Findings are unverified if repo access is not provided.