HIPAA (Health Insurance Portability and Accountability Act)

HIPAA (Health Insurance Portability and Accountability Act) of 1996 is a U.S. federal law that establishes national standards for protecting sensitive patient health information from disclosure without consent.

Encryption Implementation (Addressable Safeguard)

# PostgreSQL encryption for PHI
CREATE TABLE patients (
    patient_id SERIAL PRIMARY KEY,
    first_name TEXT,
    last_name TEXT,
    ssn BYTEA, -- Encrypted field
    date_of_birth DATE,
    medical_record_number TEXT
);

-- Encrypt sensitive data before storage
INSERT INTO patients (first_name, last_name, ssn, date_of_birth)
VALUES ('John', 'Doe', 
    pgp_sym_encrypt('123-45-6789', 'encryption_key'),
    '1980-01-01');

# HIPAA access control implementation
class HIPAAAccessControl:
    def __init__(self):
        self.minimum_necessary = True
        self.audit_log = []
    
    def access_phi(self, user_id, patient_id, purpose):
        # Verify user authorization
        if not self.verify_authorization(user_id, purpose):
            self.audit_access_attempt(user_id, patient_id, 'DENIED')
            raise PermissionError("Access denied")
        
        # Apply minimum necessary standard
        phi_data = self.get_minimum_necessary_data(
            patient_id, purpose
        )
        
        # Log access for audit trail
        self.audit_access_attempt(user_id, patient_id, 'GRANTED')
        return phi_data

Audit Logging (Required Safeguard)

# HIPAA audit logging implementation
import logging
from datetime import datetime

class HIPAAAuditLogger:
    def __init__(self):
        self.logger = logging.getLogger('hipaa_audit')
        handler = logging.FileHandler('/var/log/hipaa_audit.log')
        formatter = logging.Formatter(
            '%(asctime)s | %(user_id)s | %(action)s | %(patient_id)s | %(result)s'
        )
        handler.setFormatter(formatter)
        self.logger.addHandler(handler)
        self.logger.setLevel(logging.INFO)
    
    def log_phi_access(self, user_id, action, patient_id=None, result='SUCCESS'):
        """Log all PHI access attempts as required by HIPAA Security Rule"""
        extra = {
            'user_id': user_id,
            'action': action,
            'patient_id': patient_id or 'N/A',
            'result': result
        }
        self.logger.info(f"{action} attempt", extra=extra)
    
    def log_security_incident(self, incident_type, description, user_id=None):
        """Log security incidents for breach assessment"""
        incident_data = {
            'timestamp': datetime.utcnow().isoformat(),
            'incident_type': incident_type,
            'description': description,
            'user_id': user_id or 'SYSTEM',
            'severity': self.assess_incident_severity(incident_type)
        }
        self.logger.critical(f"Security incident: {incident_type}", extra=incident_data)