The clinical module you are about to ship
Paste the files that touch patient data. PHI Gate works out, in your browser and for free, which of the eighteen HIPAA Safe Harbor identifiers the module actually holds, every place each one reaches a log line, a URL, an analytics vendor, an exception message, an export or a cache key — and whether the redactor you already have stands between them. It reads your written policy notes alongside the code and marks every Security Rule safeguard present, absent, asserted only or contradicted. Then four model lanes over that same measurement.
Both are free and need no account: the example loads a fictional medications service with its
schema and its compliance notes, and the finished review is a saved model reply rendered locally
— no run, no charge. Paste code, schema and configuration — never a
patient record. A field named ssn is what the scanner reads; an actual number tells
it nothing more.
Patient-data exposure audit
Separate several files with a header line — === path/to/file.py ===,
# file: path or a unified diff's +++ b/path all work. One file with
no header is fine too; the paths just make the findings easier to act on.
Paste the paragraph from your security policy, your BAA tracker or your last risk analysis. Without it, every safeguard is read from the code alone, and nothing can be marked asserted only or contradicted — the two determinations a reviewer actually wants. Negation is read carefully: “PHI is never written to logs” is an assurance, “there is no audit trail” is a gap.
Three more optional inputs
A column declared only in the schema is still an identifier the module handles. Everything here is inventoried with the same classifier as the code.
Glob patterns, one per line. ** crosses directories, a leading /
anchors at the root, and a trailing / means the whole directory at any depth
— so phi/ catches app/phi/store_client.py, which a
basename-only pattern would miss. Leave it as loaded to use the defaults.
Your past reviews
Reviews you run while signed in are saved to your account and listed here, on whatever machine you are at.
What this measures, and what it cannot
Safe Harbor de-identification (45 CFR 164.514(b)(2)) works by removal: a data set is
de-identified only when all eighteen identifier categories are gone. So the first thing
PHI Gate does is count categories, not fields — a module holding names, a medical record
number and a birth date has three of the eighteen present and cannot be treated as
de-identified, however few columns that is. Direct identifiers name a person on their own;
quasi-identifiers re-identify in combination, which is why a birth date and a ZIP code together
are graded as seriously as a name; clinical content is the payload the identifiers unlock.
The mitigation decides the severity. An identifier passed straight into a logger
with no redactor anywhere in the file is critical. The same call in a file that registers a
logging filter is high — real mitigation, but it covers what it happens to cover and not
this call site. The same value wrapped in redact(...) or sha256(...) is
a low note asking somebody to confirm that redactor handles this field. Calls that write a
genuine audit record are excluded entirely: an audit trail without identifiers is not an audit
trail. Grading all four the same is how a compliance report stops being read.
And every vector says whether the data left the building. A medical record
number in a log file on your own host and the same number in a POST to an analytics vendor are
both leaks, but only one of them is a disclosure — only one needs a business
associate agreement under 45 CFR 164.308(b)(1), and only one can put a third party
in scope. So each vector is marked on-host or off-host, the counts are reported separately, and
the model is told which is which rather than being left to guess from the name of a function.
The policy notes are read as carefully as the code. Negation is tracked against each topic's polarity, because “PHI is never written to logs” and “there is no audit trail” share a word and mean opposite things. A retention period written as “about seven years” is a policy, not an absence. And a business-associate sentence naming three vendors keeps each vendor's own qualifier attached to that vendor, so “BAAs are executed with Acme and Bright Imaging; Northwind is still pending” reports Northwind as uncovered rather than losing it in the list.
What it cannot tell you: whether your organisation is compliant. There is no such thing as a
HIPAA certification, this is not a legal opinion, and it is not the risk analysis required by
45 CFR 164.308(a)(1). It reads what you paste, by name and by shape — a field
called x7 holding a Social Security number is invisible to it, and a field called
ssn holding a random integer will still be flagged. It never runs your code, never
reaches your database, and never sees a patient record; paste code, schema and configuration, and
a run sends only the measurement, which the page prints before it goes.
Common questions
Is PHI Gate a HIPAA certification?
No. There is no such thing as a HIPAA certification, and this is not a legal opinion. PHI
Gate is an engineering review of pasted code and pasted policy notes. It does not replace the
risk analysis a covered entity or business associate must perform under
45 CFR 164.308(a)(1), and it cannot see anything you did not paste.
Does my code leave the page?
The paste never leaves the page. The whole measurement — the identifier inventory, the leak vectors, the safeguard table, the clinical signals and the policy reading — runs in your browser. When you run a model lane, the app sends the measurement it computed plus a bounded sample of the flagged excerpts, and the page prints exactly what was sent before it sends it.
Should I paste real patient data into it?
No, and you never need to. PHI Gate reads source code, schema definitions and configuration
— the structures that handle patient data — not the data itself. Paste the module,
not a record. A field named ssn is what the scanner wants to see; an actual
Social Security number tells it nothing extra.
Why is an identifier in a log line sometimes critical and sometimes not?
Because the severity depends on the mitigation the code already has. A direct identifier passed straight into a logger with no redactor anywhere is critical. The same call with a redaction or hashing function wrapped round the value is a low note asking somebody to confirm that redactor covers that field. Grading both critical is how a compliance report stops being read.
What does contradicted mean in the safeguard table?
Every safeguard is looked for twice: once in the code and once in the policy notes you
pasted. Contradicted means the notes claim the control and the code shows the opposite —
the notes say all traffic is TLS-only and the module posts to a plain http://
endpoint. That gap between what an organisation believes and what it ships is the finding this
app exists to surface.
Is PHI Gate affiliated with the skills it is built on?
No. It is a derived work built on four published agent skills — @affaan-m/healthcare-phi-compliance, @affaan-m/hipaa-compliance, @affaan-m/healthcare-emr-patterns and @affaan-m/healthcare-cdss-patterns — and is not affiliated with, endorsed by or maintained by their author, nor with the U.S. Department of Health and Human Services.