HIPAA
The hipaa profile maps findings to the HIPAA Security Rule safeguards a code scan can give evidence for, mostly the technical safeguards in 164.312.
vulkro compliance . --profile hipaa
vulkro report . --profile hipaa -o hipaa-report.html
vulkro compliance-pack . --framework hipaa -o hipaa-evidence/
Controls
| Control | Title |
|---|---|
| 164.308(a)(1)(ii)(D) | Information system activity review |
| 164.308(a)(3)(ii)(B) | Workforce clearance |
| 164.308(a)(4)(ii)(B) | Access authorization |
| 164.308(a)(5)(ii)(C) | Log-in monitoring |
| 164.308(a)(5)(ii)(D) | Password management |
| 164.310(d)(2)(i) | Disposal |
| 164.312(a)(1) | Access control |
| 164.312(a)(2)(iii) | Automatic logoff (informational, not detected by a code scan) |
| 164.312(a)(2)(iv) | Encryption and decryption |
| 164.312(b) | Audit controls |
| 164.312(c)(1) | Integrity |
| 164.312(d) | Person or entity authentication |
| 164.312(e)(1) | Transmission security |
| 164.312(e)(2)(ii) | Encryption in transmission |
Typical failures: PHI endpoints with no detectable auth, admin endpoints with no role check, PHI over plaintext HTTP, PHI responses without Cache-Control: no-store, and no audit logging on PHI access paths.
PHI fields
The privacy check classifies health fields such as mrn and diagnosis in request and response shapes, which is how the checks above know which endpoints touch PHI.
See also: Compliance overview