HIPAA Compliance Map
Every HIPAA requirement that applies to ForensicShield, what it means in plain language, and exactly how we meet it.
What is HIPAA compliance?
HIPAA (Health Insurance Portability and Accountability Act) is a federal law that protects sensitive patient health information. When forensic professionals upload evaluation reports containing patient data — names, diagnoses, criminal histories, clinical findings — that data is Protected Health Information (PHI).
ForensicShield processes PHI, which means we must comply with the HIPAA Security Rule (how we protect the data technically), the HIPAA Privacy Rule (how we handle and limit use of the data), and the Breach Notification Rule (what happens if something goes wrong).
Each requirement below is either R Required — must implement — or A Addressable — must implement or document why an alternative is equivalent.
All 36 requirements, mapped.
Allow access to ePHI only to authorized persons or software programs.
- Clerk authentication with MFA gates all access to the application
- Role-based access control (RBAC) limits what each user can do
- Application-layer org-scoping on every query enforces organization-level data isolation — every read filters by organization ID and every write requires it, verified by automated cross-organization isolation tests
- PostgreSQL Row-Level Security (RLS) policies are defined on org-scoped tables as a forward-compatible safeguard (they do not currently filter application queries at runtime; moving to a database role that enforces them is on the hardening roadmap)
- 15-minute session timeout locks inactive sessions
Assign a unique name and/or number for identifying and tracking user identity.
- Every user receives a unique user ID through Clerk authentication
- All actions — uploads, views, exports, deletions — are logged against this ID
- No shared or generic accounts are permitted
Establish procedures for obtaining ePHI during an emergency.
- Automated encrypted backups with continuous point-in-time recovery support data restoration if the primary instance is lost
- Infrastructure as Code (Terraform) allows the entire environment to be rebuilt from a known-good definition
- Data export endpoint allows users to retrieve their data independently
- Emergency access procedures are documented in our Security Policies
Terminate sessions after a predetermined period of inactivity.
- 15-minute inactivity timeout enforced by ForensicShield’s server-side session manager (Redis-backed, multi-instance safe, fails closed in production — if Redis is unavailable and the session cannot be verified, access is denied)
- After timeout, the user must re-authenticate including MFA
- This prevents unauthorized access if a user walks away from their computer
Implement a mechanism to encrypt and decrypt ePHI.
- AES-256-GCM envelope encryption on all PHI database columns
- S3 SSE-KMS with customer-managed keys for uploaded files
- Keys stored in AWS Key Management Service (KMS) — separate from the data, with automatic rotation and full audit trail
- All data is encrypted at rest, always
Implement hardware, software, and/or procedural mechanisms to record and examine activity in systems that contain or use ePHI.
- 30+ audit event types logged across all data operations: uploads, views, downloads, exports, deletions, analysis runs, cross-exam sessions, citations, batch processing, admin actions, analytics, and more
- Each log entry records who, what, when, and from where with a unique request ID for end-to-end tracing
- IP addresses are HMAC-SHA-256 hashed with a versioned server-side secret before storage — no raw IPs stored
- The audit log is immutable — a PostgreSQL trigger blocks DELETE and constrains UPDATE to anonymization only (nulling identifiers on account deletion)
- PHI scrubbing middleware (multi-pattern) strips patient data from system logs so audit trails don’t themselves become a PHI exposure risk
- AWS CloudTrail logs all infrastructure-level API activity
Protect ePHI from improper alteration or destruction.
- AES-256-GCM encryption includes built-in integrity verification — the “GCM” component detects any unauthorized modification to encrypted data
- Immutable audit log — a PostgreSQL trigger blocks DELETE and constrains UPDATE to anonymization only (nulling identifiers on account deletion), ensuring tamper-proof history
- Input validation (Zod schemas on all tRPC inputs) prevents malformed data from entering the system
- AI output validation ensures analysis results conform to expected schemas
- Automated backups protect against data loss
Verify the identity of any person or entity seeking access to ePHI.
- Clerk authentication via one-time email code, Google OAuth, or passkey, with mandatory multi-factor authentication (MFA) for all users
- All interactive sessions require a second factor (authenticator app TOTP) before accessing any data — MFA cannot be disabled
- MFA is enforced at the identity provider level and verified application-side via JWT claims with Clerk API fallback — fails closed if MFA status cannot be determined
- No API-key or programmatic access path exists — every request is tied to an authenticated, MFA-verified user session
- Session tokens are cryptographically signed and validated on every request
Guard against unauthorized access to ePHI being transmitted over a network.
- TLS 1.2/1.3 enforced at the infrastructure layer (ALB and CloudFront) on all connections
- HSTS preload forces browsers to always use HTTPS, preventing downgrade attacks
- CORS whitelist restricts which domains can communicate with our API
- AI analysis traffic to Bedrock travels over AWS internal network — never the public internet
Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI.
- HIPAA Security Risk Assessment document identifies where ePHI resides (database, S3, Bedrock transit), threats (unauthorized access, data breach, insider threat), vulnerabilities, and the safeguards that address each
- Architecture designed by a 32-year defense infrastructure veteran — security was built in from day one, not bolted on
- AWS Inspector v2 performs continuous vulnerability scanning of container images with CloudWatch alerting on critical and high findings
Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
- Every identified risk has a corresponding control: encryption (data exposure), org-scoping on every query (cross-tenant access), MFA (credential theft), rate limiting (automated attacks), ClamAV scanning (malicious file uploads), prompt injection defense (AI manipulation), PHI scrubbing (log exposure), CSP/HSTS/COEP headers (browser-side attacks), file type/size restrictions (upload abuse)
- 20+ implemented technical controls directly map to identified risks
Apply appropriate sanctions against workforce members who violate security policies.
- Documented in our HIPAA Privacy and Security Policies
- As a two-person founding team (CEO Dr. Harrington, CTO Steven Harrington), sanctions include termination of access, disciplinary action, and reporting obligations
- Policies will scale with workforce growth
Regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.
- 30+ audit event types recorded on every data access
- AWS CloudTrail captures infrastructure activity
- CloudWatch monitors application health and anomalies
- Security Officer (Steven Harrington) reviews logs on a regular schedule
- Automated alerting for suspicious access patterns
Identify a Security Official responsible for developing and implementing security policies.
- Steven Harrington, CTO — designated Security Officer with 32 years of defense and classified infrastructure experience
- Built the entire security architecture
- Dr. Aubree Harrington, CEO — designated Privacy Officer who understands the clinical data and professional obligations
- Both designations formally documented
Ensure that all workforce members have appropriate access to ePHI, and prevent unauthorized access.
- Least-privilege KMS key policies — PHI decryption is granted to the application runtime roles, not to individual operators; day-to-day administrative work never touches the encryption keys
- Administrative access is break-glass, not routine — every AWS action requires an active MFA session (an IAM policy denies actions without MFA, including for account administrators), and every KMS key operation is recorded in CloudTrail
- Privileged access cannot be used quietly — every PHI access writes to an append-only audit log that database triggers protect from deletion, even by someone holding admin credentials
- IAM roles enforce separation of duties at the AWS level
- As the team grows, onboarding/offboarding checklists and background checks will be formalized
Implement policies and procedures for authorizing access to ePHI consistent with the minimum necessary standard.
- Organization-level isolation (IDOR protection) — every database query includes an organizationId filter
- Users only access their own organization’s data
- RBAC controls what actions users can perform
- The AI pipeline uses XML delimiters to separate instructions from patient data, ensuring the model processes only the data needed for each analysis pass
Implement a security awareness and training program for all workforce members.
- Both founders are trained: CTO has 32 years of classified systems experience; CEO has clinical training in PHI handling
- Formal training documentation will scale as workforce grows
- Technical controls (login monitoring, Redis-backed rate limiting for brute-force protection, ClamAV malware scanning) provide automated safeguards that reduce reliance on individual awareness
Implement policies and procedures to address security incidents.
- Breach Notification Plan documents: who is responsible (Security Officer), what triggers notification, identification and containment procedures, 60-day notification timeline per HIPAA, and communication templates
- Audit logging provides forensic evidence for incident investigation
- CloudWatch alerts provide real-time anomaly detection
Establish policies for responding to an emergency or other event that damages systems containing ePHI (data backup, disaster recovery, emergency operations).
- Continuous point-in-time recovery on both production databases (35-day window on the Dashboard database, 7-day on Edu), plus independent AWS Backup recovery points (daily 35-day tier and a weekly archival tier copied to a second AWS region)
- Automated encrypted backups restored and validated monthly in an isolated environment
- S3 versioning for uploaded files
- Infrastructure as Code (Terraform) — the entire environment can be rebuilt from a known-good definition
- Data export endpoint gives users independent access to their data
- Recovery Time Objective and Recovery Point Objective documented
Perform periodic technical and nontechnical evaluations to determine whether security policies and procedures meet HIPAA requirements.
- AWS Inspector v2 configured for continuous ECR image and Lambda vulnerability scanning with CloudWatch alerting on critical and high findings
- Application-layer DAST scanning (OWASP ZAP) runs weekly via automated CI pipeline — an unauthenticated baseline scan against production, plus an authenticated API scan of PHI-handling endpoints (tRPC and Express routes) against a staging environment with automatic Clerk session token injection and refresh
- Automated dependency auditing (Dependabot + npm audit) runs in CI on every build
- Professional penetration testing planned as part of the security evaluation program
- Annual review of all HIPAA policies and technical controls
- Continuous monitoring via CloudWatch and CloudTrail
Obtain satisfactory assurances from business associates that they will appropriately safeguard ePHI through a written contract (BAA).
- BAA is mandatory — executed with every subscriber before any PHI is uploaded
- Built into the application: the BAA acceptance flow gates access at both the frontend and backend, recording acceptance timestamps
- AWS BAA covers our infrastructure provider
- Subprocessor disclosure page publicly lists all companies that touch data (AWS, Clerk, Stripe, and the rest of the stack)
- PHI containment is simplified: only AWS touches PHI — Clerk handles auth tokens (not PHI), Stripe handles payment (not PHI)
Limit physical access to electronic information systems and the facility or facilities in which they are housed.
- ForensicShield runs entirely on AWS cloud infrastructure — there are no on-premises servers
- AWS data centers have biometric access, 24/7 armed guards, video surveillance, mantrap entries, and environmental controls
- AWS data centers are SOC 2 and ISO 27001 certified
- Physical security is inherited from AWS and independently audited
Specify proper functions for workstations and implement physical safeguards restricting access to authorized users.
- Cloud-hosted SaaS — no ePHI is stored on local workstations
- The 15-minute session timeout and MFA requirement protect against unauthorized workstation access
- All processing occurs server-side
- Downloaded exports are the user’s responsibility to secure per their own PHI handling policies
Implement policies governing the receipt and removal of hardware and electronic media that contain ePHI, including disposal and re-use.
- No ePHI on physical media — fully cloud-hosted
- AWS handles hardware destruction when drives are decommissioned (DoD 5220.22-M or NIST 800-88 compliant media sanitization)
- User-controlled deletion removes data from the active application view immediately; encrypted records are retained per the data retention policy
- Encrypted records are retained for seven years (exceeding HIPAA’s six-year documentation retention requirement)
Use or disclose only the minimum amount of PHI necessary to accomplish the intended purpose.
- PHI is used only for the purpose the user uploaded it — generating the Court Preparation Packet
- The AI pipeline uses XML delimiters to separate instructions from report data
- Bedrock serverless processes and forgets — no data retained
- PHI scrubbing middleware ensures system logs never contain patient data
- Zero use of PHI for AI training — contractually guaranteed by AWS
Individuals have a right to access their PHI maintained by a covered entity or business associate.
- Data export endpoint (dataExport.exportMyData) built into the application
- Users can export case metadata, analysis results, vulnerabilities, cross-exam sessions, annotations, citations, checklists, feedback, and their personal audit trail at any time
- Original uploaded report files are accessible via a separate authenticated download endpoint
- Exports are encrypted in transit
- User-controlled deletion removes data from the active application; encrypted records are retained for seven years (exceeding HIPAA’s six-year minimum)
Provide individuals with adequate notice of uses and disclosures of PHI and the individual’s rights.
- Privacy Policy published on the website detailing what data we collect, how we process it, where it is stored, who can access it, and user rights
- Subprocessor disclosure page lists all companies that touch data
- BAA outlines mutual obligations
- All policies are accessible before sign-up
As a Business Associate, ForensicShield must use PHI only as permitted by the BAA, implement appropriate safeguards, and report any breaches.
- The mandatory BAA executed with every subscriber defines permitted uses (analysis only), required safeguards (encryption, access controls, audit logging — among other safeguards), breach notification obligations (60-day timeline), and return/destruction of PHI upon termination
- AWS is the only subprocessor that processes report content, which simplifies our vendor chain
- PHI never leaves the AWS boundary
Notify affected individuals within 60 days of discovering a breach of unsecured PHI.
- Breach Notification Plan documents the complete process: identification, containment, risk assessment, notification timeline (within 60 days), notification content requirements, and communication templates
- Security Officer triggers the plan
- Because all PHI is encrypted with AES-256 via KMS, many exposure scenarios may qualify for the HHS encryption safe harbor (where encryption keys are not compromised). We nonetheless treat every suspected incident under the full breach-notification analysis rather than assuming the safe harbor applies
Notify HHS Secretary of breaches. Breaches affecting 500+ individuals require immediate notification; smaller breaches logged annually.
- Breach Notification Plan includes HHS notification procedures via the HHS breach reporting portal
- As a Business Associate, ForensicShield reports breaches to the affected Covered Entity (the forensic professional), who bears the notification obligation to HHS
- Our plan documents both pathways and timelines
A Business Associate must notify the Covered Entity of a breach without unreasonable delay, no later than 60 days after discovery.
- The mandatory BAA includes breach notification obligations
- Our Breach Notification Plan specifies that affected subscribers are notified within 60 days of breach discovery, consistent with the HIPAA maximum
- Where state law requires faster notification (some states mandate 30 days or less), we comply with the most restrictive applicable timeline
- Notification includes: description of breach, types of PHI involved, steps we’re taking, and steps the subscriber should take
Implement reasonable and appropriate policies and procedures to comply with the Security Rule standards.
- Seven formal HIPAA compliance documents maintained: (1) Security Risk Analysis, (2) Privacy & Security Policies, (3) Incident Response Plan, (4) Security Officer Designation, (5) Workforce Training Policy, (6) Business Associate Agreement, (7) Terms of Service & Privacy Policy
- Each references the specific technical controls that implement it
- All documents reviewed by legal counsel and updated annually
Retain documentation for 6 years from the date of creation or when it was last in effect.
- All HIPAA policies, risk assessments, BAA records, training records, and audit logs retained for minimum 7 years (exceeding HIPAA’s 6-year requirement)
- Version-controlled in the company’s document management system
- BAA acceptance timestamps stored in the database with the subscriber’s record
Review documentation periodically and update as needed in response to environmental or operational changes.
- Annual policy review scheduled
- Policies updated when: infrastructure changes, new subprocessors are added, workforce changes, or incidents occur
- All updates version-controlled with date, author, and change description
- The Security Officer is responsible for triggering reviews
HIPAA does not specifically address AI processing, but ForensicShield implements additional protections for the AI analysis pipeline.
- AWS Bedrock Serverless — no persistent machine stores data after analysis
- Zero data retention by the AI model — contractually guaranteed by AWS
- Zero AI training on customer data — also contractually guaranteed
- Prompt injection defense uses XML delimiters to prevent report content from being interpreted as instructions
- AI output validation (Zod schemas) ensures results conform to expected structure
- All AI traffic stays within the AWS boundary — PHI never leaves the secure environment
A deliberate design choice that simplifies HIPAA compliance and reduces risk.
- PHI never leaves the AWS security boundary
- Upload, storage, AI analysis (Bedrock), and output — all within AWS
- AWS is our only subprocessor with access to report content
- Clerk handles authentication tokens — not PHI
- Stripe handles payments — not PHI
- This single-boundary architecture dramatically reduces the attack surface and compliance complexity compared to systems that send PHI to multiple third parties
ForensicShield is designed to meet the requirements of the HIPAA Security Rule (45 CFR Part 164, Subpart C), the HIPAA Privacy Rule (45 CFR Part 164, Subpart E), and the Breach Notification Rule (45 CFR Part 164, Subpart D). Architecture and compliance status as of June 2026.
Your data deserves this level of protection.
Try ForensicShield on a sample report — no upload required. Then run your own.
Run a Free Sample Analysis →14-day free trial · 2 of your own reports included, plus a free sample analysis that does not count toward your 2 · A payment method is collected for identity verification — your card will not be automatically charged when the trial ends · HIPAA compliant