<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# HIPAA Technical Safeguards Audit — API Reference

## Access Control Checks (§164.312(a))

```bash
# Unique user identification — check for duplicate UIDs
awk -F: '{print $3}' /etc/passwd | sort | uniq -d

# Unique user identification — no shared accounts
awk -F: '$7 !~ /nologin|false/ {print $1}' /etc/passwd

# Automatic logoff — session timeout configured
grep -r "TMOUT" /etc/profile /etc/profile.d/ /etc/bash.bashrc

# Encryption at rest — LUKS volumes
lsblk -o NAME,FSTYPE,MOUNTPOINT | grep crypt
cryptsetup status <volume>
```

## Audit Controls (§164.312(b))

```bash
# Verify auditd running and enabled
systemctl is-active auditd
auditctl -s | grep enabled

# List ePHI-specific audit rules
auditctl -l | grep ephi

# Check audit log for ePHI access events
ausearch -k ephi_access --start today | head -20

# Verify log forwarding to SIEM
ss -tlnp | grep -E ":(514|6514|9997)"
```

## Integrity Controls (§164.312(c))

```bash
# File integrity monitoring
aide --check 2>&1 | tail -10

# Verify AIDE database exists
ls -la /var/lib/aide/aide.db

# Check integrity of critical ePHI files
sha256sum /path/to/ephi/database.db
```

## Transmission Security (§164.312(e))

```bash
# TLS configuration on ePHI endpoints
openssl s_client -connect <HOST>:443 -tls1_2 2>&1 | grep -E "Protocol|Cipher"

# Verify no weak protocols
nmap --script ssl-enum-ciphers -p 443 <HOST> | grep -E "TLSv1\.[01]"

# Check certificate validity
openssl s_client -connect <HOST>:443 2>/dev/null | openssl x509 -noout -dates
```

## §164.312 Cross-Reference

| Section | Safeguard | Type | Key Test |
|---------|-----------|------|----------|
| (a)(2)(i) | Unique user ID | Required | No shared accounts |
| (a)(2)(ii) | Emergency access | Required | Break-glass procedure exists |
| (a)(2)(iii) | Auto logoff | Addressable | TMOUT configured |
| (a)(2)(iv) | Encryption/decryption | Addressable | LUKS/encryption active |
| (b) | Audit controls | Required | auditd with ePHI rules |
| (c)(1) | Authenticate ePHI | Addressable | AIDE/integrity monitoring |
| (d) | Person authentication | Required | MFA for ePHI access |
| (e)(1) | Integrity controls | Addressable | TLS with integrity ciphers |
| (e)(2) | Encryption | Addressable | TLS 1.2+ enforced |
