hipaa-compliance

What this skill does

# HIPAA Compliance Planning

Comprehensive guidance for Health Insurance Portability and Accountability Act compliance before development begins.

## When to Use This Skill

- Building systems that handle Protected Health Information (PHI)
- Designing healthcare applications, patient portals, or medical devices
- Integrating with healthcare providers, payers, or clearinghouses
- Establishing Business Associate relationships
- Conducting HIPAA security risk assessments

## HIPAA Fundamentals

### Key Entities

| Entity Type | Definition | Requirements |
|-------------|------------|--------------|
| **Covered Entity** | Healthcare providers, health plans, clearinghouses | Full HIPAA compliance |
| **Business Associate** | Entities handling PHI on behalf of covered entities | BAA + compliance |
| **Subcontractor** | Business associates of business associates | BAA chain |

### The Three Rules

```text
1. Privacy Rule - Who can access PHI and how it can be used/disclosed
2. Security Rule - How to protect electronic PHI (ePHI)
3. Breach Notification Rule - How to respond to unauthorized disclosures
```

## Protected Health Information (PHI)

### 18 HIPAA Identifiers

When combined with health information, these become PHI:

```text
1.  Names
2.  Geographic data smaller than state
3.  Dates (except year) related to individual
4.  Phone numbers
5.  Fax numbers
6.  Email addresses
7.  Social Security numbers
8.  Medical record numbers
9.  Health plan beneficiary numbers
10. Account numbers
11. Certificate/license numbers
12. Vehicle identifiers and serial numbers
13. Device identifiers and serial numbers
14. Web URLs
15. IP addresses
16. Biometric identifiers
17. Full-face photographs
18. Any other unique identifying number/code
```

### De-identification Methods

**Safe Harbor Method:**
Remove all 18 identifiers + no actual knowledge data can identify individual

**Expert Determination:**
Qualified statistician certifies re-identification risk is very small

```csharp
// De-identification validation
public class PhiDeidentifier
{
    private static readonly HashSet<string> HipaaIdentifiers = new()
    {
        "Name", "Address", "City", "State", "Zip", "DateOfBirth",
        "Phone", "Fax", "Email", "SSN", "MRN", "HealthPlanId",
        "AccountNumber", "LicenseNumber", "VIN", "DeviceSerial",
        "URL", "IPAddress", "Biometric", "Photo", "UniqueId"
    };

    public DeidentificationResult Validate(DataSet dataset)
    {
        var violations = new List<string>();

        foreach (var column in dataset.Columns)
        {
            if (HipaaIdentifiers.Contains(column.Name, StringComparer.OrdinalIgnoreCase))
            {
                violations.Add($"Column '{column.Name}' is a HIPAA identifier");
            }

            // Check for date patterns (except year-only)
            if (column.DataType == typeof(DateTime) &&
                !column.Name.EndsWith("Year", StringComparison.OrdinalIgnoreCase))
            {
                violations.Add($"Column '{column.Name}' contains full dates");
            }

            // Check for zip codes more specific than first 3 digits
            if (column.Name.Contains("Zip", StringComparison.OrdinalIgnoreCase))
            {
                var hasFullZips = dataset.Rows
                    .Any(r => r[column.Name]?.ToString()?.Length > 3);
                if (hasFullZips)
                {
                    violations.Add($"Column '{column.Name}' contains full zip codes");
                }
            }
        }

        return new DeidentificationResult
        {
            IsDeidentified = violations.Count == 0,
            Violations = violations
        };
    }
}
```

## Security Rule Safeguards

### Administrative Safeguards

| Requirement | Description | Implementation |
|-------------|-------------|----------------|
| Security Officer | Designated responsible person | Role assignment |
| Risk Analysis | Identify vulnerabilities | Annual assessment |
| Risk Management | Mitigate identified risks | Remediation plan |
| Workforce Training | Security awareness | Training program |
| Access Authorization | Role-based access | IAM policies |
| Incident Response | Breach procedures | IR playbook |
| Contingency Plan | Disaster recovery | DR/BC plan |
| BAA Management | Third-party compliance | Contract tracking |

### Physical Safeguards

| Requirement | Description | Implementation |
|-------------|-------------|----------------|
| Facility Access | Limit physical access | Badge systems, cameras |
| Workstation Use | Policies for use | Clean desk, screen locks |
| Workstation Security | Physical protection | Cable locks, privacy screens |
| Device Controls | Media handling | Encryption, disposal procedures |

### Technical Safeguards

| Requirement | Description | Implementation |
|-------------|-------------|----------------|
| Access Control | Unique user ID | SSO, MFA |
| Audit Controls | Activity logging | SIEM, log retention |
| Integrity Controls | Prevent unauthorized alteration | Checksums, versioning |
| Transmission Security | Protect ePHI in transit | TLS 1.2+, VPN |
| Encryption | Render ePHI unusable | AES-256 |
| Auto-Logoff | Session management | Idle timeout |
| Authentication | Verify user identity | MFA, strong passwords |

### .NET Implementation Patterns

```csharp
// HIPAA-compliant audit logging
public class HipaaAuditLogger : IAuditLogger
{
    private readonly IHipaaAuditRepository _repository;
    private readonly TimeProvider _timeProvider;

    public async Task LogPhiAccess(PhiAccessEvent accessEvent, CancellationToken ct)
    {
        var auditRecord = new HipaaAuditRecord
        {
            EventId = Guid.NewGuid(),
            Timestamp = _timeProvider.GetUtcNow(),
            UserId = accessEvent.UserId,
            UserRole = accessEvent.UserRole,
            PatientId = accessEvent.PatientId,
            ResourceType = accessEvent.ResourceType,
            ResourceId = accessEvent.ResourceId,
            Action = accessEvent.Action, // Read, Create, Update, Delete
            Reason = accessEvent.Reason, // Treatment, Payment, Operations
            SourceIp = accessEvent.SourceIp,
            UserAgent = accessEvent.UserAgent,
            Success = accessEvent.Success
        };

        await _repository.WriteAuditRecord(auditRecord, ct);
    }
}

public record PhiAccessEvent
{
    public required string UserId { get; init; }
    public required string UserRole { get; init; }
    public required string PatientId { get; init; }
    public required string ResourceType { get; init; }
    public required string ResourceId { get; init; }
    public required string Action { get; init; }
    public required string Reason { get; init; }
    public required string SourceIp { get; init; }
    public required string UserAgent { get; init; }
    public required bool Success { get; init; }
}
```

```csharp
// Minimum Necessary access control
public class MinimumNecessaryFilter
{
    private readonly IRolePermissionProvider _permissions;

    public T ApplyFilter<T>(T phiRecord, string userRole, string purpose) where T : class
    {
        var allowedFields = _permissions.GetAllowedFields(
            typeof(T).Name,
            userRole,
            purpose);

        // Create filtered view with only allowed fields
        var filtered = Activator.CreateInstance<T>();
        foreach (var field in allowedFields)
        {
            var prop = typeof(T).GetProperty(field);
            if (prop != null)
            {
                prop.SetValue(filtered, prop.GetValue(phiRecord));
            }
        }

        return filtered;
    }
}

// Role-based field access configuration
public class RoleFieldPermissions
{
    public Dictionary<string, RoleAccess> Roles { get; set; } = new();
}

public class RoleAccess
{
    public List<string> Treatment { get; set; } = new(); // Fields accessible for treatment
    public List<string> Payment { get; set; } = new();