hipaa-audit

Name: hipaa-audit
Author: briiirussell

320stars36forks

How to install hipaa-audit?

briiirussell/cybersecurity-skills/hipaa-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill hipaa-audit

Installs into the current project.

Summary

Audit applications and infrastructure handling Protected Health Information against HIPAA — Security Rule (administrative, physical, technical safeguards), Privacy Rule, Breach Notification Rule, plus HITECH. Covers ePHI scoping, the 18 HIPAA identifiers, Business Associate Agree

Files · 1

View on GitHub

SKILL.md

1	# HIPAA Audit — Health Insurance Portability and Accountability Act
2
3	HIPAA governs how Protected Health Information (PHI) is handled in the United States healthcare ecosystem. The engineering surface area is large because PHI is broader than people often realize: a calendar entry naming a patient's appointment is PHI; an IP address logged on a portal accessed by a patient may be PHI in combination with a health condition.
4
5	The skill is structured around the four HIPAA rules with emphasis on the Security Rule's three safeguard categories (Administrative / Physical / Technical) — that's where engineering work happens. Privacy Rule, Breach Notification Rule, and HITECH layer on top.
6
7	Final compliance determinations stay with counsel and your privacy officer; this skill is the technical engineering layer.
8
9	Cross-references: `privacy-engineering` for the GDPR / CCPA-shaped privacy work that often overlaps; `iam-audit` for access control and authentication; `crypto-audit` for encryption-at-rest and in-transit detail; `secrets-audit` for key management; `siem-detection` for audit-log engineering; `incident-triage` and `security-comms` for breach response.
10
11	## Scope — who is covered and what is PHI
12
13	### Who must comply
14
15	- Covered entity (CE) — health plans, healthcare clearinghouses, healthcare providers who transmit health info electronically in connection with HIPAA-defined transactions
16	- Business associate (BA) — anyone who creates / receives / maintains / transmits PHI on behalf of a covered entity (cloud hosts holding PHI, SaaS analytics, EHR vendors, billing services, even some attorneys and consultants)
17	- Subcontractor of a BA — also a BA. The chain extends; every link needs a BAA with the link above
18
19	If a system handles PHI for a CE without a BAA, that's a violation regardless of how secure the handling is.
20
21	### What is PHI / ePHI
22
23	PHI = individually identifiable health information held or transmitted by a CE or BA. ePHI = the electronic form.
24
25	The 18 HIPAA identifiers (Safe Harbor de-identification list — if all are stripped, data is no longer PHI):
26
27	1. Names
28	2. Geographic subdivisions smaller than state (street, city, county, ZIP — full ZIP if population < 20,000; first 3 digits OK in most cases)
29	3. Dates more specific than year (DOB, admission, discharge, death) — for individuals over 89, even the year requires aggregation
30	4. Phone numbers
31	5. Fax numbers
32	6. Email addresses
33	7. Social Security numbers
34	8. Medical record numbers
35	9. Health plan beneficiary numbers
36	10. Account numbers
37	11. Certificate / license numbers
38	12. Vehicle identifiers and serial numbers (including license plates)
39	13. Device identifiers and serial numbers
40	14. URLs
41	15. IP addresses
42	16. Biometric identifiers (finger, voice)
43	17. Full-face photographs and comparable images
44	18. Any other unique identifying number, characteristic, or code
45
46	Important: removing the 18 identifiers via Safe Harbor is one of two de-identification methods. The other is Expert Determination (statistical analysis confirming low re-identification risk). De-identified data is not PHI; pseudonymized data is still PHI (because the key linking the surrogate back to the individual is still held somewhere).
47
48	### Scope reduction patterns
49
50	The most common scope reductions:
51
52	- Limit data classes collected — if you don't need DOB, don't collect it; don't transmit it; don't store it
53	- Pseudonymize internally where regulators allow, but understand that internal pseudonyms are still ePHI (the linking table is held by the CE / BA)
54	- Use BA-signed services where possible — AWS, Google Cloud, Azure, Stripe Healthcare, certain analytics vendors sign BAAs; many SaaS tools do not
55	- Use services that contractually commit to never receive PHI — analytics platforms that scrub on ingest, error reporters with strict PII filtering
56
57	## Security Rule — the three safeguard categories
58
59	### Administrative safeguards (program-level)
60
61	These are policy and program controls. Engineering teams contribute artifacts; the privacy officer owns the program.
62
63	- §164.308(a)(1) Security Management Process — risk analysis (the foundati

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# HIPAA Audit — Health Insurance Portability and Accountability Act

HIPAA governs how Protected Health Information (PHI) is handled in the United States healthcare ecosystem. The engineering surface area is large because PHI is

The skill is structured around the four HIPAA rules with emphasis on the Security Rule's three safeguard categories (Administrative / Physical / Technical) — th

Final compliance determinations stay with counsel and your privacy officer; this skill is the technical engineering layer.

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type

hipaa-audit

320stars36forks

View on GitHub

How to install hipaa-audit?

briiirussell/cybersecurity-skills/hipaa-audit

$npx -y skills add briiirussell/cybersecurity-skills --skill hipaa-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# HIPAA Audit — Health Insurance Portability and Accountability Act
2
3	HIPAA governs how Protected Health Information (PHI) is handled in the United States healthcare ecosystem. The engineering surface area is large because PHI is broader than people often realize: a calendar entry naming a patient's appointment is PHI; an IP address logged on a portal accessed by a patient may be PHI in combination with a health condition.
4
5	The skill is structured around the four HIPAA rules with emphasis on the Security Rule's three safeguard categories (Administrative / Physical / Technical) — that's where engineering work happens. Privacy Rule, Breach Notification Rule, and HITECH layer on top.
6
7	Final compliance determinations stay with counsel and your privacy officer; this skill is the technical engineering layer.
8
9	Cross-references: `privacy-engineering` for the GDPR / CCPA-shaped privacy work that often overlaps; `iam-audit` for access control and authentication; `crypto-audit` for encryption-at-rest and in-transit detail; `secrets-audit` for key management; `siem-detection` for audit-log engineering; `incident-triage` and `security-comms` for breach response.
10
11	## Scope — who is covered and what is PHI
12
13	### Who must comply
14
15	- Covered entity (CE) — health plans, healthcare clearinghouses, healthcare providers who transmit health info electronically in connection with HIPAA-defined transactions
16	- Business associate (BA) — anyone who creates / receives / maintains / transmits PHI on behalf of a covered entity (cloud hosts holding PHI, SaaS analytics, EHR vendors, billing services, even some attorneys and consultants)
17	- Subcontractor of a BA — also a BA. The chain extends; every link needs a BAA with the link above
18
19	If a system handles PHI for a CE without a BAA, that's a violation regardless of how secure the handling is.
20
21	### What is PHI / ePHI
22
23	PHI = individually identifiable health information held or transmitted by a CE or BA. ePHI = the electronic form.
24
25	The 18 HIPAA identifiers (Safe Harbor de-identification list — if all are stripped, data is no longer PHI):
26
27	1. Names
28	2. Geographic subdivisions smaller than state (street, city, county, ZIP — full ZIP if population < 20,000; first 3 digits OK in most cases)
29	3. Dates more specific than year (DOB, admission, discharge, death) — for individuals over 89, even the year requires aggregation
30	4. Phone numbers
31	5. Fax numbers
32	6. Email addresses
33	7. Social Security numbers
34	8. Medical record numbers
35	9. Health plan beneficiary numbers
36	10. Account numbers
37	11. Certificate / license numbers
38	12. Vehicle identifiers and serial numbers (including license plates)
39	13. Device identifiers and serial numbers
40	14. URLs
41	15. IP addresses
42	16. Biometric identifiers (finger, voice)
43	17. Full-face photographs and comparable images
44	18. Any other unique identifying number, characteristic, or code
45
46	Important: removing the 18 identifiers via Safe Harbor is one of two de-identification methods. The other is Expert Determination (statistical analysis confirming low re-identification risk). De-identified data is not PHI; pseudonymized data is still PHI (because the key linking the surrogate back to the individual is still held somewhere).
47
48	### Scope reduction patterns
49
50	The most common scope reductions:
51
52	- Limit data classes collected — if you don't need DOB, don't collect it; don't transmit it; don't store it
53	- Pseudonymize internally where regulators allow, but understand that internal pseudonyms are still ePHI (the linking table is held by the CE / BA)
54	- Use BA-signed services where possible — AWS, Google Cloud, Azure, Stripe Healthcare, certain analytics vendors sign BAAs; many SaaS tools do not
55	- Use services that contractually commit to never receive PHI — analytics platforms that scrub on ingest, error reporters with strict PII filtering
56
57	## Security Rule — the three safeguard categories
58
59	### Administrative safeguards (program-level)
60
61	These are policy and program controls. Engineering teams contribute artifacts; the privacy officer owns the program.
62
63	- §164.308(a)(1) Security Management Process — risk analysis (the foundati

briiirussellPublisher · 30 listings

Preview

briiirussell/cybersecurity-skills

# HIPAA Audit — Health Insurance Portability and Accountability Act

HIPAA governs how Protected Health Information (PHI) is handled in the United States healthcare ecosystem. The engineering surface area is large because PHI is

The skill is structured around the four HIPAA rules with emphasis on the Security Rule's three safeguard categories (Administrative / Physical / Technical) — th

Final compliance determinations stay with counsel and your privacy officer; this skill is the technical engineering layer.

Repobriiirussell/cybersecurity-skills

LicenseMIT

TypeSkills

CategorySecurity

UpdatedMay 2026

Repo stars320

First seenJul 22, 2026

People who liked this also viewed

6 picks

Type