HIPAA Gap Analysis
by @krishnakumarmahadevan-cmd
Assess HIPAA compliance across all five rule areas, identify 32 control gaps, and generate a prioritized remediation plan with compliance scoring and audit r...
clawhub install toolweb-hipaa-gap-analysisπ About This Skill
HIPAA Gap Analysis
Assess your organization's HIPAA compliance posture across all five rule areas β Administrative Safeguards, Physical Safeguards, Technical Safeguards, Privacy Rule, and Breach Notification Rule. Covers all 32 control areas required for covered entities and business associates. Produces a gap report with compliance score, identified deficiencies, and a prioritized remediation roadmap.
Usage
{
"tool": "hipaa_gap_analysis",
"input": {
"organization_name": "Sunrise Health Clinic",
"organization_type": "Covered Entity",
"entity_size": "Small",
"services_provided": ["Primary Care", "Telehealth", "Lab Services"],
"phi_volume": "Medium",
"phi_types": ["Medical Records", "Billing Information", "Lab Results"],
"workforce_size": 45,
"locations_count": 3,
"cloud_services": true,
"third_party_vendors": true,
"mobile_devices": true,
"security_officer_assigned": true,
"workforce_training": false,
"access_management": true,
"contingency_plan": false,
"incident_response": false,
"risk_assessment_conducted": true,
"business_associate_agreements": true,
"facility_access_controls": true,
"workstation_use_controls": false,
"device_media_controls": false,
"access_control_systems": true,
"audit_controls": false,
"integrity_controls": false,
"transmission_security": true,
"privacy_officer_assigned": true,
"notice_of_privacy_practices": true,
"patient_rights_procedures": true,
"minimum_necessary_procedures": false,
"complaints_process": true,
"breach_notification_procedures": false,
"breach_risk_assessment": false
}
}
Parameters
All fields are required.
Organization Profile
| Field | Type | Description |
|-------|------|-------------|
| organization_name | string | Name of the organization being assessed |
| organization_type | string | e.g., Covered Entity, Business Associate, Hybrid Entity |
| entity_size | string | Small, Medium, Large |
| services_provided | array of strings | List of healthcare services offered |
| phi_volume | string | Volume of PHI handled: Low, Medium, High |
| phi_types | array of strings | Types of PHI: e.g., Medical Records, Billing Information, Lab Results, Mental Health Records |
| workforce_size | integer | Total number of employees/contractors |
| locations_count | integer | Number of physical locations |
| cloud_services | boolean | Whether cloud services are used to store/process PHI |
| third_party_vendors | boolean | Whether third-party vendors have access to PHI |
| mobile_devices | boolean | Whether mobile devices are used to access PHI |
Administrative Safeguards
| Field | Type | Description |
|-------|------|-------------|
| security_officer_assigned | boolean | Designated Security Officer in place |
| workforce_training | boolean | Regular HIPAA workforce training conducted |
| access_management | boolean | Formal access management procedures exist |
| contingency_plan | boolean | Data backup and disaster recovery plan exists |
| incident_response | boolean | Security incident response procedures in place |
| risk_assessment_conducted | boolean | Formal risk assessment has been conducted |
| business_associate_agreements | boolean | BAAs executed with all relevant vendors |
Physical Safeguards
| Field | Type | Description |
|-------|------|-------------|
| facility_access_controls | boolean | Physical access controls for facilities with PHI |
| workstation_use_controls | boolean | Workstation use and security policies in place |
| device_media_controls | boolean | Controls for hardware/media containing PHI |
Technical Safeguards
| Field | Type | Description |
|-------|------|-------------|
| access_control_systems | boolean | Technical access controls (unique user IDs, auto-logoff, etc.) |
| audit_controls | boolean | Audit logs for PHI access and activity |
| integrity_controls | boolean | Controls to ensure PHI is not improperly altered or destroyed |
| transmission_security | boolean | Encryption/security for PHI in transit |
Privacy Rule
| Field | Type | Description |
|-------|------|-------------|
| privacy_officer_assigned | boolean | Designated Privacy Officer in place |
| notice_of_privacy_practices | boolean | NPP distributed and acknowledged |
| patient_rights_procedures | boolean | Procedures for patient access, amendment, and accounting |
| minimum_necessary_procedures | boolean | Minimum necessary standard applied to PHI use/disclosure |
| complaints_process | boolean | Process for receiving and handling privacy complaints |
Breach Notification Rule
| Field | Type | Description |
|-------|------|-------------|
| breach_notification_procedures | boolean | Breach notification procedures documented |
| breach_risk_assessment | boolean | Process for conducting breach risk assessment in place |
What You Get
Example Output
{
"organization": "Sunrise Health Clinic",
"overall_score": 62,
"compliance_rating": "Partial Compliance",
"audit_readiness": "Moderate Risk",
"rule_scores": {
"administrative_safeguards": { "score": 71, "gaps": 2 },
"physical_safeguards": { "score": 33, "gaps": 2 },
"technical_safeguards": { "score": 50, "gaps": 2 },
"privacy_rule": { "score": 80, "gaps": 1 },
"breach_notification": { "score": 0, "gaps": 2 }
},
"critical_gaps": [
"No breach notification procedures β OCR Tier 3/4 penalty exposure",
"No breach risk assessment process β required for all incidents",
"Workstation use controls absent β PHI exposure risk at endpoints",
"No audit controls β inability to detect or prove unauthorized access"
],
"immediate_actions": [
"Document and implement breach notification procedures (7 days)",
"Deploy workstation lock/encryption policy (14 days)",
"Enable audit logging on all systems accessing PHI (7 days)"
],
"penalty_exposure": "Tier 3 β Willful Neglect (up to $50,000 per violation)"
}
API Reference
Base URL: https://portal.toolweb.in/apis/compliance/hipaa-gap-analysis
| Endpoint | Method | Description |
|----------|--------|-------------|
| /hipaa-analysis | POST | Run full HIPAA gap assessment |
Authentication: Pass your API key as X-API-Key header or mcp_api_key argument via MCP.
Pricing
| Plan | Daily Limit | Monthly Limit | Price | |------|-------------|---------------|-------| | Free | 5 / day | 50 / month | $0 | | Developer | 20 / day | 500 / month | $39 | | Professional | 200 / day | 5,000 / month | $99 | | Enterprise | 100,000 / day | 1,000,000 / month | $299 |
About
ToolWeb.in β 200+ security APIs, CISSP & CISM certified, built for enterprise compliance practitioners.
Platforms: Pay-per-run Β· API Gateway Β· MCP Server Β· OpenClaw Β· RapidAPI Β· YouTube
π‘ Examples
{
"tool": "hipaa_gap_analysis",
"input": {
"organization_name": "Sunrise Health Clinic",
"organization_type": "Covered Entity",
"entity_size": "Small",
"services_provided": ["Primary Care", "Telehealth", "Lab Services"],
"phi_volume": "Medium",
"phi_types": ["Medical Records", "Billing Information", "Lab Results"],
"workforce_size": 45,
"locations_count": 3,
"cloud_services": true,
"third_party_vendors": true,
"mobile_devices": true,
"security_officer_assigned": true,
"workforce_training": false,
"access_management": true,
"contingency_plan": false,
"incident_response": false,
"risk_assessment_conducted": true,
"business_associate_agreements": true,
"facility_access_controls": true,
"workstation_use_controls": false,
"device_media_controls": false,
"access_control_systems": true,
"audit_controls": false,
"integrity_controls": false,
"transmission_security": true,
"privacy_officer_assigned": true,
"notice_of_privacy_practices": true,
"patient_rights_procedures": true,
"minimum_necessary_procedures": false,
"complaints_process": true,
"breach_notification_procedures": false,
"breach_risk_assessment": false
}
}