HIPAA
The HIPAA Security Rule mandates administrative, physical, and technical safeguards for electronic protected health information (ePHI). Gadriel Code maps to the Technical Safeguards and portions of the Administrative Safeguards that leave source evidence.
Related: Compliance overview · SOC 2 · PCI-DSS.
At a glance
| Property | Value |
|---|---|
| Slug | hipaa |
| Aliases | (none) |
| Controls | 14 |
| Manual-only | 7 |
| Machine-assessable | 7 |
| Direct mapping key | hipaa |
Half of HIPAA's controls are administrative/policy in nature and are manual-only here. A PASS on the assessable half does not imply HIPAA compliance — pair with your organization's policy documentation, BAAs, and workforce-training records.
Generating the report
bashgadriel code report --compliance hipaa
Outputs: .security/compliance/hipaa.{md,typ,pdf}.
What Gadriel evaluates
The predicated half focuses on Technical Safeguards — §164.312:
- Access Control (
§164.312(a)) — authentication, unique user identification, emergency access. - Audit Controls (
§164.312(b)) — logging and audit trails in code. - Integrity (
§164.312(c)) — data integrity verification. - Transmission Security (
§164.312(e)) — TLS/encryption in transit, disallowed cleartext channels.
Rules carry compliance_mapping.hipaa: 164.312(a)(1) (etc.).
PHI, BAAs, and scope
Gadriel does not know which fields in your code represent PHI, nor which of your dependencies are covered by a Business Associate Agreement. Treat the report as the technical half of a broader HIPAA engagement.