HIPAA technical safeguards
HIPAA technical safeguards are the five standards in 45 CFR §164.312 (access control (unique IDs, emergency access, auto-logoff, encryption), audit controls, integrity, authentication, and transmission security) protecting ePHI in information systems. Caisson's Compliance bundle crosswalks every §164.312 citation to an own-authored canonical control, backing what it implements in code: fail-closed RLS, field encryption, the WORM audit log.
In code
{
id: "AUDIT.CONTROLS",
title: "Audit controls over ePHI systems",
family: "Technical Safeguards",
statement:
"Hardware, software, or procedural mechanisms record and examine activity in systems that " +
"contain or use ePHI, so that access and changes are attributable and reviewable.",
crosswalk: [
{ framework: "HIPAA-Security", reference: "164.312(b)" },
{
framework: "SOC2-TSC",
reference: "CC7.2",
note: "Satisfied by the immutable audit log.",
},
],
},How it holds
Own-authored, not ingested
hipaa-security.ts is clean-room Caisson prose validated at module load, no NIST 800-66 or SCF (CC-BY-ND) text is copied or paraphrased. Crosswalk references carry only the bare CFR citation id (e.g. 164.312(b)), a factual pointer to the safeguard, never its regulatory text.
One canonical control, many framework crosswalks
Canonical control ids are framework-agnostic and shared across packs, AUDIT.CONTROLS crosswalks to both HIPAA 164.312(b) and SOC 2 CC7.2 in the same entry, so one control satisfies two frameworks' evidence requirements without duplicating logic.
Flag-never-guess evidence
A collector never infers a passing status it can't evidence: passResult requires a satisfied automated check, flaggedResult/unresolvedResult mandate a recorded reason, and unresolved evidence hard-blocks the pack, no partial pack ships silently.
Six-year retention floor
The GOVERNANCE.DOCUMENTATION control ties §164.316's documentation-retention requirement to the WORM retention helper, which enforces the HIPAA six-year floor so evidence can't be disposed of early.