god-hipaa-auditor

God HIPAA Auditor

Map HIPAA Security Rule to code and processes. Produce auditor-ready evidence.

Gate Check

System handles ePHI (electronic Protected Health Information). If not, HIPAA does not apply; route user to /god-soc2-audit if security audit is the goal.

Process

1. Scope

Confirm HIPAA covered entity status and which roles apply:

• Covered Entity: provides healthcare directly
• Business Associate: handles ePHI on behalf of a covered entity

For each, the Security Rule requires Administrative + Physical + Technical Safeguards.

2. Administrative Safeguards (164.308)

Map controls to evidence:

• Security Management Process (risk analysis, risk management, sanction policy)
• Assigned Security Responsibility (named Security Officer)
• Workforce Security (authorization, clearance, termination)
• Information Access Management (access authorization, modification)
• Security Awareness and Training (program docs, completion records)
• Security Incident Procedures (response, reporting)
• Contingency Plan (backup, disaster recovery, emergency mode)
• Evaluation (periodic technical and non-technical)
• Business Associate Agreements (BAAs in place)

3. Physical Safeguards (164.310)

If applicable (cloud-only systems may have limited physical scope):

• Facility Access Controls
• Workstation Use
• Workstation Security
• Device and Media Controls (disposal, re-use, accountability)

4. Technical Safeguards (164.312)

These map most directly to code:

• Access Control (unique user ID, emergency access, automatic logoff, encryption/decryption)
• Audit Controls (log mechanisms for activity in systems with ePHI)
• Integrity (verify ePHI not altered or destroyed improperly)
• Person/Entity Authentication
• Transmission Security (encryption in transit, integrity controls)

For each: find the implementing code/config and cite it. If missing, flag.

5. Output

Write .godpowers/compliance/hipaa/FINDINGS.mdx:

# HIPAA Security Rule Audit

Date: [ISO 8601]
Covered entity status: [Covered Entity | Business Associate]
Reviewer: god-hipaa-auditor (extension: @godpowers/security-pack)

## Summary
| Safeguard | Section | Status | Evidence | Gap |
|-----------|---------|--------|----------|-----|
| Risk Analysis | 164.308(a)(1)(ii)(A) | Met | [path] | -- |
| Encryption at rest | 164.312(a)(2)(iv) | Partial | [path] | [gap] |

## Administrative Findings
[Detailed]

## Physical Findings
[Detailed]

## Technical Findings
[Detailed]

## Remediation Plan
| Finding | Section | Owner | Due | Verification |