Compliance Assessment
Which privacy obligations your data puts at risk.
An article-by-article assessment of the personal information found against the active framework — the evidence behind each obligation, and the actions to close the gaps.
Framework
HIPAA
Active compliance framework
11 PII types
assessed
Articles triggered
1/5
Framework articles engaged
HIPAA
active framework
Special category
0
GDPR Art 9 / sensitive
0 types
special-category
Restricted
6,996
Most-sensitive findings
3% of findings
restricted items
Risk posture
65
Exposure index
Elevated exposure
A high share of identifiable records carry restricted-grade PII (TFN, Medicare, passport), concentrated in a small number of documents.
6,996 restricted-grade findingsCompliance assessment
307,385 scanned · 2,218 partial · 632 declined · 22,844 excluded · 182 failed
Top actions to take
- 1.Privacy-RuleVerify all PHI access paths map to permitted purposes (treatment, payment, healthcare operations).
- 2.Privacy-RuleObtain patient authorization for any non-permitted use identified in scan findings.
Article-by-article assessment
Privacy-Rule
Privacy Rule — permitted uses and disclosures of PHI
Protected Health Information may only be used/disclosed as permitted by the rule or with authorization.
Evidence from this scan
| PII type | Sensitivity | Findings | Files |
|---|---|---|---|
| Person Name | internal | 20,740 | 11,389 |
| Date of Birth | confidential | 198,556 | 67,691 |
Recommended actions
- Verify all PHI access paths map to permitted purposes (treatment, payment, healthcare operations).
- Obtain patient authorization for any non-permitted use identified in scan findings.
Security-164.312-a
Security Rule — Access Control (164.312(a))
Technical safeguards: unique user identification, automatic logoff, encryption/decryption where appropriate.
Evidence from this scan
No findings in this scan touch this principle.
Security-164.312-c
Security Rule — Integrity (164.312(c))
Policies and procedures to protect electronic PHI from improper alteration or destruction.
Evidence from this scan
No findings in this scan touch this principle.
Security-164.312-e
Security Rule — Transmission Security (164.312(e))
Encrypt ePHI whenever deemed appropriate for transmission over an electronic communications network.
Evidence from this scan
No findings in this scan touch this principle.
Breach-Notification
Breach Notification Rule
Covered entities must notify affected individuals, HHS, and (for large breaches) media within 60 days of discovery.
Evidence from this scan
No findings in this scan touch this principle.
Health Insurance Portability and Accountability Act · HHS Office for Civil Rights (OCR)