{"uid":"cap_v7YIDoUkmvwWt-1LQIOu8","slug":"hipaa-clinical-privacy-suite-4f534cb4","name":"HIPAA & Clinical Privacy Suite","description":"Composite health privacy audit: HIPAA Safe Harbor 18-identifier de-identification (45 CFR 164.514(b)), Security Rule ePHI encryption, audit controls & BAA (164.312), HITECH breach notice 60-day window & 500-person HHS/media threshold (164.404-408), FTC Health Breach Notification Rule (16 CFR 318) for apps/wearables. Returns score, grade, 4 sub-checks, ranked fixes. Not legal advice.","url":"https://x402-niche-briefs.fly.dev/v1/suite/hipaa-and-clinical-privacy?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["identifiers_removed","encryption_at_rest","audit_logs","baa_signed","breach_days_since_discovery","individuals_affected","notified","consumer_app_shares_data"],"properties":{"notified":{"type":"string","description":"Required notices already sent"},"audit_logs":{"type":"string","description":"Audit controls logging ePHI access"},"baa_signed":{"type":"string","description":"BAAs executed with all vendors"},"encryption_at_rest":{"type":"string","description":"ePHI encrypted at rest and in transit"},"identifiers_removed":{"type":"string","description":"Number of 18 Safe Harbor identifiers removed"},"individuals_affected":{"type":"string","description":"Individuals affected by breach"},"consumer_app_shares_data":{"type":"string","description":"Non-HIPAA consumer health app shares data without authorization"},"breach_days_since_discovery":{"type":"string","description":"Days since breach discovery (0 = no breach)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["suite_id","title","price_usdc","as_of","inputs","composite_readiness_score","executive_grade","verdict","passing_checks","estimated_remediation_items","avg_subcheck_pct","sub_checks","prioritized_remediation_checklist","disclaimer"],"properties":{"as_of":{"type":"string"},"title":{"type":"string"},"inputs":{"type":"object","required":["identifiers_removed","encryption_at_rest","audit_logs","baa_signed","breach_days_since_discovery","individuals_affected","notified","consumer_app_shares_data"],"properties":{"notified":{"type":"boolean"},"audit_logs":{"type":"boolean"},"baa_signed":{"type":"boolean"},"encryption_at_rest":{"type":"boolean"},"identifiers_removed":{"type":"number"},"individuals_affected":{"type":"number"},"consumer_app_shares_data":{"type":"boolean"},"breach_days_since_discovery":{"type":"number"}}},"verdict":{"type":"string"},"suite_id":{"type":"string"},"disclaimer":{"type":"string"},"price_usdc":{"type":"number"},"sub_checks":{"type":"array","items":{"type":"object","required":["check_id","name","regulation","score","max_score","status","finding"],"properties":{"name":{"type":"string"},"score":{"type":"number"},"status":{"type":"string"},"finding":{"type":"string"},"check_id":{"type":"string"},"max_score":{"type":"number"},"regulation":{"type":"string"}}}},"passing_checks":{"type":"number"},"executive_grade":{"type":"string"},"avg_subcheck_pct":{"type":"number"},"composite_readiness_score":{"type":"number"},"estimated_remediation_items":{"type":"number"},"prioritized_remediation_checklist":{"type":"array"}}}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.05","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.05/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.05","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_e9Ogrbc34Zt5Npz4aqlJR","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.05","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a healthcare organization's HIPAA Safe Harbor de-identification, ePHI encryption, audit controls, BAA compliance, breach notification timing, and FTC Health Breach Notification Rule adherence, returning a composite score, grade, sub-checks, and ranked remediation steps.","exampleAgentPrompt":"Run a HIPAA and clinical privacy audit for us: we've removed 15 of the 18 Safe Harbor identifiers, ePHI is encrypted at rest and in transit, we have audit logs enabled, all BAAs are signed, a breach happened 45 days ago affecting 600 individuals, we've already sent required notices, and our consumer health app does not share data without authorization — give us our compliance score, grade, and the top fixes we need to make.","exampleUseCases":[{"title":"Post-breach HHS notification deadline check","prompt":"We discovered a data breach 52 days ago affecting 700 patients — we've sent notifications, all BAAs are signed, encryption is on, audit logs are enabled, and we removed 17 of 18 Safe Harbor identifiers. Our consumer app doesn't share data without auth. Score our HIPAA compliance and tell us if we're at risk of missing the 60-day HITECH breach notification window."},{"title":"Pre-audit HIPAA readiness assessment for a health startup","prompt":"We're preparing for a HIPAA audit at our digital health startup. We've removed 16 of 18 Safe Harbor identifiers, encryption at rest and in transit is in place, audit logs are running, BAAs are all signed, no breach has occurred, zero individuals affected, no notices sent yet, and our consumer app doesn't share health data without authorization. What's our HIPAA readiness score and what should we fix first?"},{"title":"FTC Health Breach Rule check for a wearable app","prompt":"Our fitness wearable app shares some user health data with third parties without explicit authorization — no breach has happened, 0 individuals affected, no notices sent, we've removed 12 of 18 Safe Harbor identifiers, encryption is on, audit logs are off, and BAAs aren't fully signed. Run the HIPAA and clinical privacy suite audit and tell us our score and what rules we're violating."}],"resultDescription":"Returns a JSON object with a suite_id, title, as_of timestamp, echoed inputs, composite readiness score (numeric), executive grade (letter), verdict text, count of passing checks, average sub-check percentage, estimated remediation items, detailed sub-check results covering Safe Harbor de-identification, ePHI Security Rule controls, HITECH breach notification, and FTC Health Breach Notification Rule, plus a prioritized remediation checklist with ranked action items. Includes a disclaimer that results are not legal advice.","failureModes":["Missing required query parameters returns a 400 or validation error","Invalid enum or out-of-range values for numeric fields may cause unexpected scoring","Endpoint may return stale regulatory mappings if underlying rule references are not updated","Payment failure via x402 protocol results in 402 Payment Required with no audit output","Ambiguous string inputs for boolean fields (e.g. audit_logs, baa_signed) may cause misclassification"],"whenToPreferThis":"Choose this endpoint when you need a fast, structured, multi-regulation health privacy compliance check that spans HIPAA Safe Harbor de-identification, Security Rule ePHI controls, HITECH breach notification timelines, and FTC Health Breach Notification Rule in a single scored response. Ideal for digital health startups, wearable app developers, or healthcare organizations wanting a quick compliance readiness snapshot before an audit or after a breach incident, without engaging a legal team for an initial triage.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:41:50.303Z","isFirstParty":false,"canonicalSlug":"hipaa-clinical-privacy-suite-4f534cb4"}