HIPAA Compliance Auditor
Audit healthcare operations against HIPAA rules with automated risk scoring
What You Can Do
You get a systematic HIPAA compliance audit that evaluates your healthcare operations against the Privacy and Security Rules, identifies gaps by severity level, and generates prioritized remediation roadmaps. The skill scores your overall compliance risk and delivers actionable findings with specific remediation steps, timelines, and ownership assignments so you can strategically close compliance gaps and reduce breach risk.
Features
Evaluate your organization against all major HIPAA Privacy and Security Rule requirements, including administrative, physical, and technical safeguards across all business functions.
Receive an overall compliance risk score (0-100) with findings classified by severity level (Critical, Major, Moderate, Minor) to focus remediation efforts on highest-impact items first.
Identify specific compliance gaps organized by HIPAA rule (Access Control, Encryption, Audit Logging, Incident Response, etc.) with clear explanations of what's missing and business impact.
Get a prioritized action plan for each finding, including remediation steps, estimated timelines, required resources, cost estimates, and assigned ownership.
Systematically evaluate your policies, procedures, Business Associate Agreements, risk assessments, and training records against HIPAA requirements with specific improvement recommendations.
Assess your staff's privacy training, authorization levels, role-based access controls, and compliance awareness against Privacy Rule workforce requirements.
Review your encryption, access logging, network security, backup procedures, disaster recovery, and monitoring systems against Security Rule technical safeguard standards.
Example Output
## HIPAA Compliance Assessment Report
**Organization:** Riverside Medical Clinic | **Audit Date:** 2024-08-07 | **Overall Risk Score:** 68/100 (Moderate Risk)
### Critical Findings (Immediate Action Required)
**1. Access Control — EHR Overprivileging**
- **Issue:** 45% of clinical staff have administrative access to the EHR system
- **HIPAA Rule:** 45 CFR § 164.312(a)(2)(i) — Access Controls
- **Risk:** Unauthorized access to patient data, audit trail compromise
- **Remediation Steps:**
1. Audit all user roles against job functions (Week 1)
2. Implement least-privilege access model (Weeks 2–4)
3. Revoke excessive permissions and retest access (Week 5)
- **Owner:** IT Director | **Timeline:** 30 days | **Estimated Cost:** $12,000
**2. Encryption — Patient Data at Rest**
- **Issue:** Backup hard drives in storage lack full-disk encryption
- **HIPAA Rule:** 45 CFR § 164.312(a)(2)(ii)(B) — Encryption and Decryption
- **Risk:** Unauthorized access if media is stolen or lost
- **Remediation:** Deploy BitLocker/FileVault across backup devices within 45 days
- **Owner:** IT Security | **Timeline:** 45 days | **Estimated Cost:** $8,500
### Compliance Strengths
✓ Business Associate Agreements — All current and properly signed
✓ Annual Risk Assessment — Completed Q1 2024
✓ Incident Response Plan — Document reviewed and updated
✓ Workforce Privacy Training — 95% completion rate
What's Included
- Full HIPAA Assessment Framework: Structured evaluation covering Privacy Rule, Security Rule, and Breach Notification Rule requirements across administrative, physical, and technical domains.
- Risk Scoring Methodology: Quantitative framework that assesses likelihood and impact of compliance gaps to produce overall organizational compliance score and prioritization matrix.
- Gap Analysis Templates: Documented templates for evaluating policies, procedures, technical controls, workforce training, and Business Associate Agreements against HIPAA standards.
- Remediation Roadmaps: Detailed action plans for each finding with specific steps, timelines, resource requirements, cost estimates, and ownership assignments.
- Compliance Evidence Checklist: Comprehensive checklist of all required HIPAA documentation, policies, training records, audit logs, and agreements you should maintain.
Who It's For
- Compliance Officers & Risk Management Directors
- Healthcare IT Security & Privacy Teams
- Practice Managers & Operations Directors
- Internal Audit & Compliance Departments
- Health IT Consultants & Compliance Advisors
Best For
- Annual HIPAA compliance assessments
- Pre-audit preparation and gap remediation planning
- Breach risk evaluation and mitigation
- Privacy and security policy documentation review
- Workforce training effectiveness and access control audits
You might also like
Analyze your organization's corruption exposure across vendors, business units, and geographies to identify risk hotspots. Generate customized anti-corruption policies, due diligence procedures, and compliance frameworks aligned to FCPA and UK Bribery Act standards. Evaluate third-party compliance profiles and detect red flags in vendor questionnaires and regulatory filings.
by joabgonzalez
You can systematically design, audit, and strengthen your corporate whistleblower programs using structured frameworks that ensure legal compliance, protect reporters from retaliation, and reduce organizational risk. This skill generates comprehensive compliance checklists, policy templates, and risk assessments tailored to your industry and regulatory environment. You'll produce documentation that leadership, legal, and compliance teams can immediately implement to create safer, more effective reporting channels.
by joabgonzalez
You can design comprehensive data collection protocols that reduce errors, ensure consistency across multiple sites or staff, and produce trustworthy evaluation data. This skill helps you build scalable systems with built-in quality checks, staff training materials, and bias mitigation—enabling your team to collect clean, reliable data even with high turnover or complex populations.
by joabgonzalez
You extract powerful qualitative and quantitative evidence from your evaluation datasets and construct narrative arcs that connect program logic (activities → outputs → outcomes → impact). Claude systematically synthesizes survey responses, interview transcripts, program metrics, and participant feedback into compelling case studies, impact stories, and donor-ready reports that prove program effectiveness without overstating results.
by joabgonzalezYou'll transform your idea into a professionally formatted, market-ready ebook that's ready to sell on Amazon, your website, or anywhere else in just two days. This skill walks you through a battle-tested system that handles everything from manuscript structure to cover design to launch strategy, eliminating all the confusion that usually stretches ebook creation into months. You'll have a completed, polished product and a live sales page by Monday morning.
by joabgonzalez
You can take raw input from coalition members—surveys, one-on-ones, working group notes—and synthesize it into unified strategy documents, position statements, and action plans that reflect genuine consensus rather than tokenistic agreement. The skill surfaces alignment gaps and disagreements early so you can facilitate resolution before publishing, building authentic buy-in and accountability across all partners.
by joabgonzalez
Organize disparate data streams from surveys, interviews, admin records, and observations into a cohesive analysis framework. Cross-validate findings across quantitative and qualitative methods to identify robust patterns and surface anomalies. Generate documented, bias-checked conclusions aligned to your theory of change that stakeholders can confidently act on.
by joabgonzalez
You can rapidly analyze dozens or hundreds of qualitative responses—interviews, focus groups, open-ended survey answers, and participant feedback—to extract themes, patterns, and evidence of program impact. Claude codes responses against your logic model or emergent themes, flags anomalies where outcomes diverge from expectations, and generates frequency tables and quote libraries that substantiate your evaluation reports with real participant data.
by joabgonzalez