What problem does it solve? Manually verifying HIPAA Technical Safeguards (45 CFR 164.312) across a healthcare codebase is slow and error-prone. This Skill systematically greps a Django backend for access control gaps, missing audit logging, unencrypted PHI fields, insecure transmission settings, and Privacy Rule violations, then produces a structured compliance matrix with evidence and remediation steps. ## Core Features & Use Cases - Section-by-Section Audits: Run targeted checks for access controls, audit controls, integrity, transmission security, encryption at rest, minimum necessary, BAA boundaries, or Privacy Rule requirements. - PHI Model Targeting: Audits specific PHI-containing models (Notes, UserResponse, Appointment, Session) for IDOR vulnerabilities, missing permission classes, and overexposed serializers. - Compliance Matrix Output: Generates a dated Markdown or JSON report mapping each HIPAA requirement to PASS/FAIL status, file-level evidence, and concrete remediation such as installing django-auditlog. - Use Case: Before deploying a telehealth feature touching clinical notes, run a full audit to confirm every PHI endpoint enforces authentication, role-based authorization, and audit logging, then hand the matrix to your compliance officer. ## Quick Start Ask the AI to run a HIPAA compliance audit on the backend codebase and generate the full compliance matrix report.
