<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-hipaa-technical-safeguards
description: >-
  Audit HIPAA Security Rule technical safeguards (§164.312) including access
  controls, audit controls, integrity controls, person authentication, and
  transmission security. Automate ePHI protection validation with InSpec
  profiles and automated evidence collection for covered entities and BAs.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - hipaa
  - security-rule
  - technical-safeguards
  - ephi
  - healthcare
  - audit-controls
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing HIPAA Technical Safeguards

## Overview

HIPAA Security Rule §164.312 mandates technical safeguards for ePHI protection
across five areas: access control, audit controls, integrity controls, person
or entity authentication, and transmission security. Each contains required
and addressable implementation specifications. This skill automates validation
of technical controls and evidence collection for OCR audit readiness.

Mode: `[MODE: BLUE]` — Healthcare compliance validation and ePHI protection audit.

## Prerequisites

| Requirement | Install |
|---|---|
| InSpec | `gem install inspec` |
| OpenSSL | For encryption validation |
| Python 3.10+ | For agent tooling |
| auditd | `apt install auditd` |

## Key Concepts

### Technical Safeguard Requirements (§164.312)

```
§164.312 Technical Safeguards:
├── (a) Access Control (Required)
│   ├── (a)(1) Unique user identification — Required
│   ├── (a)(2)(i) Emergency access procedure — Required
│   ├── (a)(2)(ii) Automatic logoff — Addressable
│   ├── (a)(2)(iii) Encryption and decryption — Addressable
│   └── (a)(2)(iv) [Reserved]
├── (b) Audit Controls — Required
│   └── Record and examine access to ePHI systems
├── (c) Integrity — Required
│   └── (c)(1) Mechanism to authenticate ePHI — Addressable
├── (d) Person or Entity Authentication — Required
│   └── Verify identity of persons seeking ePHI access
└── (e) Transmission Security — Required
    ├── (e)(1) Integrity controls — Addressable
    └── (e)(2) Encryption — Addressable
```

### InSpec Profile — HIPAA Technical Safeguards

```ruby
# controls/hipaa_164_312.rb

control 'hipaa-312-a1' do
  impact 1.0
  title 'Unique user identification (§164.312(a)(2)(i))'
  desc 'Each user accessing ePHI must have a unique identifier.'

  describe shadow.where { password == '' } do
    its('users') { should be_empty }
  end

  describe file('/etc/pam.d/common-auth') do
    its('content') { should match(/pam_unix\.so/) }
  end
end

control 'hipaa-312-a2iii' do
  impact 1.0
  title 'Encryption and decryption (§164.312(a)(2)(iii))'
  desc 'ePHI at rest must be encrypted using validated cryptography.'

  describe command('lsblk -o NAME,FSTYPE | grep -c crypt') do
    its('stdout.strip.to_i') { should be >= 1 }
  end
end

control 'hipaa-312-b' do
  impact 1.0
  title 'Audit controls (§164.312(b))'
  desc 'Hardware, software, and procedural mechanisms to record ePHI access.'

  describe service('auditd') do
    it { should be_enabled }
    it { should be_running }
  end

  describe auditd.where { key == 'ephi_access' } do
    its('rules') { should_not be_empty }
  end
end

control 'hipaa-312-e2' do
  impact 1.0
  title 'Transmission security — encryption (§164.312(e)(2)(ii))'
  desc 'Encrypt ePHI in transit over electronic networks.'

  describe ssl(host: 'ehr.example.com', port: 443) do
    it { should be_enabled }
    its('protocols') { should_not include 'TLSv1.0' }
    its('protocols') { should_not include 'TLSv1.1' }
  end
end
```

### Automated Validation Commands

```bash
# Access Control — verify unique user IDs
awk -F: '{print $3}' /etc/passwd | sort | uniq -d

# Access Control — check automatic logoff (TMOUT)
grep -r "TMOUT" /etc/profile /etc/profile.d/ /etc/bash.bashrc

# Audit Controls — verify audit daemon and rules
auditctl -l | grep -c ephi
journalctl -u auditd --since "1 hour ago" | head -20

# Integrity — check file integrity monitoring
aide --check 2>&1 | tail -5
rpm -Va --nofiles --nodigest 2>/dev/null | head -20

# Transmission Security — validate TLS on ePHI endpoints
openssl s_client -connect ehr.example.com:443 -tls1_2 2>&1 | \
  grep -E "(Protocol|Cipher|Verify)"

# Person Authentication — MFA configuration
grep -E "^auth.*pam_google_authenticator" /etc/pam.d/sshd
```

## Workflow

### Step 1: Scope ePHI Systems

```bash
node scripts/agent.js --action scope --systems "EHR,Lab,Pharmacy" \
  --output /tmp/hipaa-scope.json
```

### Step 2: Test Technical Safeguards

```bash
node scripts/agent.js --action audit --safeguards access,audit,transmission \
  --target localhost --output /tmp/hipaa-audit.json
```

### Step 3: Generate OCR Audit Evidence

```bash
node scripts/agent.js --action report --input /tmp/hipaa-audit.json \
  --output /tmp/hipaa-evidence.json
```

## Verification

- [ ] All ePHI systems identified and access controls verified
- [ ] Unique user identification enforced (no shared accounts)
- [ ] Audit logging captures all ePHI access events
- [ ] Encryption at rest validated (AES-256 or equivalent)
- [ ] TLS 1.2+ enforced for all ePHI transmission
- [ ] Automatic logoff configured on workstations
- [ ] File integrity monitoring active on ePHI stores
- [ ] Breach notification procedures documented and tested

## References

- [HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/)
- [NIST SP 800-66 Rev 2](https://csrc.nist.gov/publications/detail/sp/800-66/rev-2/final)
- [HHS OCR Audit Protocol](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/)
- [HITRUST CSF](https://hitrustalliance.net/hitrust-csf/)
