<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# HIPAA Safeguards Auditing — API Reference

## InSpec HIPAA Resources

```bash
# Run HIPAA technical safeguards profile
inspec exec hipaa-profile -t ssh://user@target --reporter json:/tmp/hipaa.json

# Run specific safeguard controls
inspec exec hipaa-profile --controls hipaa-164.312-a-1 hipaa-164.312-b

# Target AWS environment
inspec exec hipaa-profile -t aws:// --reporter json:/tmp/hipaa-aws.json
```

## ePHI Discovery

```bash
# AWS: Find S3 buckets tagged with ePHI classification
aws s3api list-buckets --query 'Buckets[].Name' --output json | \
  xargs -I{} aws s3api get-bucket-tagging --bucket {} 2>/dev/null | \
  jq 'select(.TagSet[] | .Key == "data_classification" and .Value == "ePHI")'

# AWS: Find RDS instances with ePHI
aws rds describe-db-instances --output json | \
  jq '.DBInstances[] | select(.TagList[] | .Key == "data_classification")'

# Check CloudTrail for ePHI access events
aws cloudtrail lookup-events --lookup-attributes \
  AttributeKey=ResourceType,AttributeValue=AWS::S3::Object \
  --max-results 50 --output json
```

## HIPAA Standard Coverage

| Section | Standard | Type | Automatable |
|---------|----------|------|-------------|
| §164.308(a)(1) | Security Management | Admin | Partial |
| §164.308(a)(5) | Security Awareness | Admin | No |
| §164.310(b)(1) | Workstation Use | Physical | No |
| §164.312(a)(1) | Access Control | Technical | Yes |
| §164.312(b) | Audit Controls | Technical | Yes |
| §164.312(c)(1) | Integrity | Technical | Yes |
| §164.312(d) | Authentication | Technical | Yes |
| §164.312(e)(1) | Transmission Security | Technical | Yes |

## Breach Notification Thresholds

```
§164.402 — Breach presumption unless low probability of compromise:
├── Nature and extent of PHI involved
├── Unauthorized person who used/accessed PHI
├── Whether PHI was actually acquired or viewed
└── Extent to which risk has been mitigated

§164.404 — Individual notification: without unreasonable delay, ≤60 days
§164.408 — HHS notification: ≤60 days if ≥500 individuals; annual if <500
§164.406 — Media notification: if ≥500 in a state/jurisdiction
```
