HIPAA Safeguards Skill

HIPAA's Security Rule is a list of safeguards for electronic protected health information (ePHI), split into administrative, physical, and technical — some required, some addressable (you must do them or document why an equivalent is reasonable). This skill maps your controls to that list, runs the risk analysis HIPAA mandates, and flags where you're exposed — so handling PHI is defensible, not hopeful.

Required Inputs

Ask for these only if they aren't already provided:

• Your role — covered entity, or business associate (a vendor handling PHI for one). Both owe Security Rule safeguards.
• The ePHI flow — where PHI is created, received, stored, transmitted, and who can access it.
• Current safeguards — what's in place for access control, encryption, audit logging, backups, training.
• Business associates — third parties touching PHI (each needs a BAA).

Output Format

HIPAA Assessment: [entity] ([covered entity / business associate])

1. ePHI inventory & flow — where PHI lives and moves; the systems in scope.

2. Safeguards — a table per category; status met / partial / gap, and required vs. addressable:

3. Risk analysis — the required (§164.308(a)(1)) assessment: threats to ePHI, likelihood × impact, and the residual risk after controls. This is the control auditors check first and the one most often missing.

4. BAA scope — which business associates need a Business Associate Agreement, and what each must guarantee.

5. Remediation — prioritised gaps (required-and-gap first), owners, dates. For addressable items not implemented, the documented justification + alternative.

Programmatic Helper

scripts/hipaa_checklist.py (stdlib only) scores safeguard coverage and surfaces unmet required safeguards (the ones with no "addressable" escape hatch):

# safeguards.json: [{"category":"Technical","safeguard":"...","required":true,"status":"met|partial|gap"}, ...]
python3 scripts/hipaa_checklist.py safeguards.json
python3 scripts/hipaa_checklist.py safeguards.json --json

Quality Checks

• [ ] A documented security risk analysis exists (or is the top remediation item) — it's required and foundational
• [ ] Each safeguard is marked required vs. addressable, and addressable-not-done items have a written justification + alternative
• [ ] Encryption of ePHI in transit and at rest is assessed explicitly
• [ ] Every business associate has (or is flagged as needing) a BAA
• [ ] Audit logging / access review for PHI access is covered

Anti-Patterns

• [ ] Do not treat "addressable" as "optional" — you must implement it or document why an equivalent is reasonable; silence is a violation
• [ ] Do not skip the risk analysis — it's explicitly required and the most-cited gap in OCR enforcement
• [ ] Do not handle PHI through a vendor without a BAA — that alone is a breach
• [ ] Do not present this as legal certification — flag that compliance counsel / a security assessor must validate, especially the risk analysis
• [ ] Do not conflate HIPAA with SOC 2 or GDPR — overlapping controls, different legal requirements; map each separately

Based On

HIPAA Security Rule (45 CFR §164.308–312) — administrative, physical, and technical safeguards + required risk analysis.