HIPAA Safeguards Skill

HIPAA's Security Rule is a list of safeguards for electronic protected health information (ePHI), split into administrative, physical, and technical — some required, some addressable (you must do them or document why an equivalent is reasonable). This skill maps your controls to that list, runs the risk analysis HIPAA mandates, and flags where you're exposed — so handling PHI is defensible, not hopeful.

Required Inputs

Ask for these only if they aren't already provided:

• Your role — covered entity, or business associate (a vendor handling PHI for one). Both owe Security Rule safeguards.
• The ePHI flow — where PHI is created, received, stored, transmitted, and who can access it.
• Current safeguards — what's in place for access control, encryption, audit logging, backups, training.
• Business associates — third parties touching PHI (each needs a BAA).

Output Format

HIPAA Assessment: [entity] ([covered entity / business associate])