HIPAA mapping
This page maps the HIPAA Security Rule technical safeguards (45 CFR 164.312) onto the vulkro-sf checks that produce evidence for them.
vulkro-sf compliance hipaa-matrix ./force-app -o hipaa-matrix.md
vulkro-sf compliance bundle hipaa ./force-app -o hipaa-bundle.md
hipaa-matrix marks each safeguard Pass, Partial or Fail. Exit code 1 means at least one safeguard is Partial or Fail. To widen the PII checks (AP-015, AP-016, AP-017) with the 18 HIPAA Safe Harbor identifier classes, run vulkro-sf antipatterns . --compliance=hipaa.
For web app, API and storage evidence, see the general HIPAA page.
Technical safeguards covered
| Standard | Title | Checks that feed it |
|---|---|---|
| 164.312(a)(1) | Access Control | profiles-permsets (ModifyAllData, ViewAllData or object View All on PHI objects), security-settings (session timeout) |
| 164.312(a)(2)(i) | Unique User Identification | profiles-permsets (SSO without MFA, shared credentials) |
| 164.312(a)(2)(iii) | Automatic Logoff | security-settings (sessionTimeout above baseline) |
| 164.312(a)(2)(iv) | Encryption and Decryption | apex (weak hashes, hardcoded keys, deprecated cipher modes, insecure random) |
| 164.312(b) | Audit Controls | security-settings (EventLogFile retention), live org (Field Audit Trail on PHI objects, Login History retention) |
| 164.312(c)(1) | Integrity | apex (CRUD/FLS on write paths) |
| 164.312(d) | Person or Entity Authentication | security-settings (MFA, SAML signature algorithm, SAML assertion encryption) |
| 164.312(e)(1) | Transmission Security | security-settings (requireHttps), connected-apps (OAuth scope review) |
| 164.312(e)(2)(i) | Integrity Controls (in transit) | connected-apps (https:// callback URLs), named-credentials (TLS endpoints) |
| 164.312(e)(2)(ii) | Encryption (in transit) | security-settings (TLS 1.2 minimum), named-credentials |
PHI inventory
The PII map lists PHI fields by object, ranked by field count. It covers standard Health Cloud objects and common custom names such as MRN__c, DOB__c, Diagnosis__c, Medication__c, SSN__c and MemberID__c. Use it as input to the risk analysis (164.308(a)(1)(ii)(A)).
Third-party agreements
vulkro-sf compliance baa-verify lists Named Credentials, Connected Apps and hardcoded Apex endpoints that send data to a vendor with no recorded BAA in .vulkro-sf/data-agreements.yaml (finding SF-COMPLIANCE-BAA-001). The BAA itself is yours to sign.
Not covered
Administrative safeguards (164.308), physical safeguards (164.310), organizational requirements (164.314) and documentation requirements (164.316) need a Security Officer, written policies, training records and signed BAAs. A scanner does not produce them.
See also: Compliance overview, PCI-DSS profile