<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-hipaa-safeguards
description: >-
  Audit HIPAA Security Rule safeguards including administrative, physical, and
  technical controls for ePHI protection. Automate compliance checks against
  18 standards and 36 implementation specifications using InSpec and OPA.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - hipaa
  - ephi
  - security-rule
  - healthcare
  - privacy
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing HIPAA Safeguards

## Overview

HIPAA Security Rule establishes safeguards for electronic Protected Health Information
(ePHI) across administrative, physical, and technical domains. This skill automates
validation of the 18 standards and 36 implementation specifications, focusing on
access controls, audit logging, encryption, and integrity mechanisms.

Mode: `[MODE: BLUE]` — Compliance validation; `[MODE: PRIVACY]` — PHI data flow analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| InSpec (`gem install inspec`) | Required |
| OPA (`brew install opa`) | Required |
| AWS CLI (for cloud ePHI environments) | Required |

## Key Concepts

### HIPAA Security Rule Structure

```
Security Rule Standards:
├── Administrative Safeguards (§164.308)
│   ├── (a)(1) Security Management Process [Required]
│   │   ├── Risk Analysis [R]
│   │   ├── Risk Management [R]
│   │   ├── Sanction Policy [R]
│   │   └── Information System Activity Review [R]
│   ├── (a)(3) Workforce Security
│   │   ├── Authorization/Supervision [A]
│   │   ├── Workforce Clearance [A]
│   │   └── Termination Procedures [A]
│   ├── (a)(4) Information Access Management
│   │   ├── Access Authorization [A]
│   │   └── Access Establishment/Modification [A]
│   ├── (a)(5) Security Awareness Training [Required]
│   ├── (a)(6) Security Incident Procedures [Required]
│   ├── (a)(7) Contingency Plan [Required]
│   └── (a)(8) Evaluation [Required]
├── Physical Safeguards (§164.310)
│   ├── (a)(1) Facility Access Controls
│   ├── (b)(1) Workstation Use [Required]
│   ├── (c)(1) Workstation Security [Required]
│   └── (d)(1) Device and Media Controls
└── Technical Safeguards (§164.312)
    ├── (a)(1) Access Control [Required]
    │   ├── Unique User Identification [R]
    │   ├── Emergency Access Procedure [R]
    │   ├── Automatic Logoff [A]
    │   └── Encryption and Decryption [A]
    ├── (b)(1) Audit Controls [Required]
    ├── (c)(1) Integrity [Addressable]
    ├── (d)(1) Person or Entity Authentication [Required]
    └── (e)(1) Transmission Security
        ├── Integrity Controls [A]
        └── Encryption [A]

[R] = Required, [A] = Addressable
```

### InSpec Profile — HIPAA Technical Safeguards

```ruby
# controls/hipaa_technical.rb
control 'hipaa-164.312-a-1' do
  impact 1.0
  title 'Access Control — Unique User Identification'
  desc 'Assign a unique name/number for identifying and tracking user identity.'
  tag hipaa: '164.312(a)(2)(i)'
  tag nist: ['IA-2']

  describe shadow.where { password == '' } do
    its('users') { should be_empty }
  end

  describe passwd.where { uid == 0 } do
    its('users') { should eq ['root'] }
  end
end

control 'hipaa-164.312-a-4' do
  impact 0.7
  title 'Access Control — Encryption and Decryption'
  desc 'Implement mechanism to encrypt and decrypt ePHI.'
  tag hipaa: '164.312(a)(2)(iv)'
  tag nist: ['SC-28']

  describe command('lsblk -o NAME,FSTYPE,MOUNTPOINT,TYPE | grep crypt') do
    its('stdout') { should_not be_empty }
  end
end

control 'hipaa-164.312-b' do
  impact 1.0
  title 'Audit Controls'
  desc 'Implement mechanisms to record and examine access to ePHI.'
  tag hipaa: '164.312(b)'
  tag nist: ['AU-2', 'AU-3']

  describe service('auditd') do
    it { should be_installed }
    it { should be_enabled }
    it { should be_running }
  end

  describe auditd.where { key == 'ephi_access' } do
    its('rules') { should_not be_empty }
  end
end

control 'hipaa-164.312-e-2' do
  impact 1.0
  title 'Transmission Security — Encryption'
  desc 'Encrypt ePHI in transit over electronic networks.'
  tag hipaa: '164.312(e)(2)(ii)'
  tag nist: ['SC-8']

  describe ssl(port: 443) do
    it { should be_enabled }
    its('protocols') { should_not include 'TLSv1.0' }
    its('protocols') { should_not include 'SSLv3' }
  end
end
```

### OPA Policy — Cloud ePHI Access

```rego
# policy/hipaa_aws.rego
package hipaa.aws

# S3 buckets with ePHI must have encryption enabled
deny[msg] {
    bucket := input.s3_buckets[_]
    bucket.tags["data_classification"] == "ePHI"
    not bucket.server_side_encryption.enabled
    msg := sprintf("S3 bucket %v contains ePHI but lacks encryption", [bucket.name])
}

# ePHI databases must have audit logging enabled
deny[msg] {
    db := input.rds_instances[_]
    db.tags["data_classification"] == "ePHI"
    not db.audit_logging_enabled
    msg := sprintf("RDS %v stores ePHI but audit logging is disabled", [db.identifier])
}

# ePHI access requires MFA
deny[msg] {
    user := input.iam_users[_]
    user.policies[_].resources[_] == "arn:aws:s3:::ephi-*"
    not user.mfa_enabled
    msg := sprintf("User %v accesses ePHI but lacks MFA", [user.name])
}
```

## Workflow

### Step 1: Map ePHI Data Flows

```bash
node scripts/agent.js --action map-ephi --target-env aws \
  --output /tmp/hipaa-dataflow.json
```

### Step 2: Audit Technical Safeguards

```bash
node scripts/agent.js --action audit --profile ./controls/ \
  --safeguard-type technical --output /tmp/hipaa-audit.json
```

### Step 3: Generate Gap Analysis

```bash
node scripts/agent.js --action gap-analysis --input /tmp/hipaa-audit.json \
  --output /tmp/hipaa-gaps.json
```

## Verification

- [ ] All 18 HIPAA Security Rule standards assessed
- [ ] Required vs addressable specifications documented
- [ ] ePHI data flow inventory complete
- [ ] Technical safeguards validated (access, audit, encryption, integrity)
- [ ] BAA agreements verified for all third-party processors
- [ ] Risk analysis current within 12 months (§164.308(a)(1))
- [ ] Audit logs capture all ePHI access events

## References

- [HHS HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/)
- [NIST SP 800-66 Rev2 — HIPAA Security Rule Guide](https://csrc.nist.gov/publications/detail/sp/800-66/rev-2/final)
- [OCR Audit Protocol](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/)
