Hipaa Audit

HIPAA Audit — Health Insurance Portability and Accountability Act

HIPAA governs how Protected Health Information (PHI) is handled in the United States healthcare ecosystem. The engineering surface area is large because PHI is broader than people often realize: a calendar entry naming a patient's appointment is PHI; an IP address logged on a portal accessed by a patient may be PHI in combination with a health condition.

The skill is structured around the four HIPAA rules with emphasis on the Security Rule's three safeguard categories (Administrative / Physical / Technical) — that's where engineering work happens. Privacy Rule, Breach Notification Rule, and HITECH layer on top.

Final compliance determinations stay with counsel and your privacy officer; this skill is the technical engineering layer.

Cross-references: privacy-engineering for the GDPR / CCPA-shaped privacy work that often overlaps; iam-audit for access control and authentication; crypto-audit for encryption-at-rest and in-transit detail; secrets-audit for key management; siem-detection for audit-log engineering; incident-triage and security-comms for breach response.

Scope — who is covered and what is PHI

Who must comply

• Covered entity (CE) — health plans, healthcare clearinghouses, healthcare providers who transmit health info electronically in connection with HIPAA-defined transactions
• Business associate (BA) — anyone who creates / receives / maintains / transmits PHI on behalf of a covered entity (cloud hosts holding PHI, SaaS analytics, EHR vendors, billing services, even some attorneys and consultants)
• Subcontractor of a BA — also a BA. The chain extends; every link needs a BAA with the link above

If a system handles PHI for a CE without a BAA, that's a violation regardless of how secure the handling is.

What is PHI / ePHI

PHI = individually identifiable health information held or transmitted by a CE or BA. ePHI = the electronic form.

The 18 HIPAA identifiers (Safe Harbor de-identification list — if all are stripped, data is no longer PHI):

1. Names
2. Geographic subdivisions smaller than state (street, city, county, ZIP — full ZIP if population 500 in a state or jurisdiction |

| Business associate to covered entity | Without unreasonable delay, no later than 60 days |

A "breach" includes the unauthorized access — not just exfiltration. If a workforce member views a record they had no need to view, that is a breach (unless one of the limited exceptions applies).

Engineering hook: ability to scope a breach quickly. Audit logs (Security Rule §164.312(b)) are the source of truth. Time-to-scope directly impacts the 60-day clock.

Safe harbor: if the PHI was encrypted per HHS-recognized standards (and the key wasn't also compromised), the unauthorized acquisition may not be a breach. This is the strongest reason to encrypt ePHI at rest comprehensively.

See incident-triage (response), security-comms (notification draft — legal review required), breach-patterns (post-incident pattern extraction).

HITECH layer

HITECH (2009) strengthened HIPAA in several ways relevant here:

• Made BAs directly liable for many Security Rule violations (was previously CE-only)
• Increased civil monetary penalties (tiered up to $1.5M per provision per year)
• Made the Breach Notification Rule federal (replacing some state-level patchwork)
• Strengthened the right of patients to obtain electronic copies of their PHI

For modern engineering work, HITECH means: a BA that handles ePHI is subject to most of the Security Rule directly. Vendors cannot hide behind the CE.

Audit checklist

# HIPAA Audit Findings
## Entity: [name]
## Entity type: Covered Entity / Business Associate / Subcontractor
## Date: [date]
## Auditor: [name]

### Scope
- [ ] ePHI inventory complete (every data store containing PHI)
- [ ] Data flow diagrams for PHI transmission paths
- [ ] BAA in place with every BA (and BA's subcontractors where required)
- [ ] Cloud provider BAA on file (AWS / GCP / Azure / etc.)
- [ ] Risk analysis (§164.308(a)(1)(ii)(A)) current

### Administrative safeguards
| Subsection | Status | Findings |
|------------|--------|----------|
| Security Management Process | | |
| Assigned Security Responsibility | | |
| Workforce Security | | |
| Information Access Management | | |
| Security Awareness and Training | | |
| Security Incident Procedures | | |
| Contingency Plan | | |
| Evaluation | | |
| BA Contracts | | |

### Technical safeguards
| Subsection | Status | Findings |
|------------|--------|----------|
| Access Control — unique IDs | | |
| Access Control — emergency access | | |
| Access Control — automatic logoff | | |
| Access Control — encryption at rest | | |
| Audit Controls | | |
| Integrity | | |
| Person / Entity Authentication (MFA) | | |
| Transmission Security (encryption in transit) | | |

### Privacy Rule
- [ ] Minimum necessary applied in code (no SELECT * on PHI tables)
- [ ] Notice of Privacy Practices published and presented
- [ ] Individual access path implemented (30-day delivery)
- [ ] Amendment / accounting of disclosures process exists

### Breach response readiness
- [ ] Audit logs sufficient to scope a breach within 60-day clock
- [ ] Incident-response procedures tested
- [ ] Notification templates drafted (see security-comms)
- [ ] Encryption-as-safe-harbor verified across ePHI stores

### Findings detail
[Per finding: section reference, severity, location, evidence, remediation]

### Recommendations
[Prioritized]

Disposition rule (Fixed / Deferred / Accepted Risk) per owasp-audit. HIPAA accepted-risk is highly disfavored — most "accepted risks" should be documented as residual risk with compensating controls and re-evaluation triggers.

Common audit findings (real-world starting hypotheses)

• PHI in non-BAA vendor pipelines — Sentry, Datadog, Mixpanel, Segment, Slack receiving PHI without a BAA (Sentry has a BAA path; Datadog has a healthcare offering; Mixpanel does not by default — verify each vendor's BAA stance)
• Unique-user-ID violation via shared service accounts — engineering team uses a shared admin account for ad-hoc PHI access
• SELECT * on PHI tables — minimum-necessary violation; API serializers returning all fields when callers need few
• DOB stored when only age range needed — minimization gap
• Backups encrypted but with key co-located — safe harbor depends on key separation
• Lower environments seeded from production — staging DB contains real PHI from a prod dump
• MFA not enforced for all ePHI access paths — pre-2024 environments may have gaps; trend is toward universal MFA requirement
• Audit log retention < 6 years — HIPAA's 6-year retention applies to documentation required by the rules, including audit logs that evidence compliance
• No automatic logoff on ePHI-accessing workstations / clinical applications
• BA chain breaks — vendor's subcontractor handles ePHI but the BA never put their own BAA in place with the subcontractor

Boundaries

• This skill is the engineering audit and preparation. Privacy Officer / counsel make final determinations on covered-entity status, BA relationships, and notification decisions
• Refuse to help build flows that violate HIPAA — PHI to non-BAA vendors, shared-account access to PHI, transmission of PHI via end-user messaging tech (consumer email, SMS, chat) outside narrow authorization, marketing uses of PHI without authorization
• For breaches: this skill scopes the breach and produces engineering inputs to the notification; the notification itself goes through security-comms and counsel
• HIPAA enforcement (OCR) has expanded since 2013; regulatory interpretation continues to evolve. Where this skill's content lags current OCR guidance, current OCR guidance prevails
• State laws may impose stricter requirements (e.g., Texas HB 300, California CMIA) — preempted only where state law is less protective; otherwise state requirements apply on top
• Genetic information has additional protections under GINA — out of scope here, refer to specialized guidance

References

• HHS HIPAA Rules — hhs.gov/hipaa (regulatory text, FAQs, OCR resolution agreements)
• HHS / OCR Audit Protocol — used by OCR auditors; useful checklist for self-assessment
• HHS Security Risk Assessment Tool — free tool for small/medium providers
• NIST SP 800-66 Rev. 2 (2024) — "Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide" — the most current technical guidance
• HITRUST CSF — common controls framework that maps to HIPAA Security Rule; many BAs pursue HITRUST certification as compliance evidence
• OCR Resolution Agreements — published enforcement actions; useful precedent for what OCR considers material
• HHS Wall of Shame — public breach portal; useful for industry-pattern context
• 45 CFR Parts 160 and 164 — the regulatory text itself
• OCR Cybersecurity Newsletter — quarterly guidance updates
• "HIPAA Plain & Simple" — Carolyn P. Hartley — practitioner reference

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: briiirussell
• Source: briiirussell/cybersecurity-skills
• License: MIT

Install and usage instructions live in the source repository linked above.