HIPAA Safeguards Skill

HIPAA's Security Rule is a list of safeguards for electronic protected health information (ePHI), split into administrative, physical, and technical — some required, some addressable (you must do them or document why an equivalent is reasonable). This skill maps your controls to that list, runs the risk analysis HIPAA mandates, and flags where you're exposed — so handling PHI is defensible, not hopeful.

Required Inputs

Ask for these only if they aren't already provided:

• Your role — covered entity, or business associate (a vendor handling PHI for one). Both owe Security Rule safeguards.
• The ePHI flow — where PHI is created, received, stored, transmitted, and who can access it.
• Current safeguards — what's in place for access control, encryption, audit logging, backups, training.
• Business associates — third parties touching PHI (each needs a BAA).

Output Format

HIPAA Assessment: [entity] ([covered entity / business associate])

1. ePHI inventory & flow — where PHI lives and moves; the systems in scope.

2. Safeguards — a table per category; status met / partial / gap, and required vs. addressable:

Category	Safeguard	Req/Addr	Status	Notes
Technical	Encryption of ePHI at rest & in transit	Addressable	partial	TLS yes; disk encryption pending
Administrative	Security risk analysis	Required	gap	Not yet performed
Physical	Facility access controls	Required	met

3. Risk analysis — the required (§164.308(a)(1)) assessment: threats to ePHI, likelihood × impact, and the residual risk after controls. This is the control auditors check first and the one most often missing.