US · HIPAA
Health Insurance Portability and Accountability Act
HIPAA's Security Rule requires administrative, physical and technical safeguards for electronic protected health information (ePHI). RuleFix covers the technical safeguards your code is responsible for.
Example findingrulefix scan --format json
{
"rule": "hipaa.phi-fields",
"framework": "HIPAA",
"severity": "high",
"file": "app/api/signup.ts",
"check": "PHI fields flagged and encrypted",
"status": "failed",
"fix": { "available": true, "files": 2 }
}Key requirements
What HIPAA expects from engineering.
- 01
Access control
Unique user identification, emergency access and automatic logoff for ePHI systems.
- 02
Audit controls
Record and examine activity in systems that contain or use ePHI.
- 03
Integrity
Protect ePHI from improper alteration or destruction.
- 04
Transmission security
Guard ePHI against unauthorised access in transit.
- 05
Minimum necessary
Limit use and disclosure of PHI to the minimum necessary.
- 06
Business associates
Ensure vendors handling PHI are covered by business associate agreements.
What RuleFix checks
Turned into code rules.
- PHI fields flagged and encrypted
- Access logs on PHI reads
- Session timeouts
- PHI kept out of analytics and logs
- TLS for all PHI transport
Official sources
Read the source.
RuleFix links to primary sources so you can check the requirements yourself. We are not affiliated with these bodies.
Other frameworks
Cover more with the same workflow.
DPDP
GDPR
LGPD
Ship AI-powered products
that are compliant by design.
Join developers building with RuleFix.