name: hipaa-basic
description: HIPAA Basic Compliance Guidelines
category: security
rules:
  - "Encrypt all Protected Health Information (PHI) at rest using AES-256 — this includes databases, backups, and file storage"
  - "Encrypt all PHI in transit using TLS 1.2+ — never send health data over unencrypted channels"
  - "Apply the minimum necessary principle — only request, display, and process the specific PHI fields needed for the task"
  - "Implement role-based access control (RBAC) so users only see PHI relevant to their job function"
  - "Log all access to PHI with immutable audit trails — record who accessed what, when, and why"
  - "Retain audit logs for at least six years as required by HIPAA retention rules"
  - "Never include PHI in URLs, query parameters, client-side storage, or application logs"
  - "Require unique user IDs and enforce multi-factor authentication for all systems containing PHI"
  - "Implement automatic session timeout (15 minutes or less of inactivity) for applications accessing PHI"
  - "Verify that all third-party services handling PHI have signed a Business Associate Agreement (BAA) before integration"
  - "Implement a breach notification mechanism — HIPAA requires notification within 60 days of discovering a breach"
  - "Provide a mechanism for patients to request access to, amendment of, and an accounting of disclosures of their PHI"
  - "Run regular risk assessments on all systems that store, process, or transmit PHI — document findings and remediation"
  - "Ensure PHI is completely and irreversibly deleted when no longer needed — including backups and replicas"
  - "De-identify data according to HIPAA Safe Harbor (remove all 18 identifiers) before using it for analytics or testing"