hipaa-gap-analysis_skill

Overview

This skill performs a systematic HIPAA gap analysis of compliance documents against the HIPAA Security Rule and Privacy Rule. It produces structured findings for each control that include coverage status, confidence scores, verbatim evidence citations, gap descriptions, and concrete remediation steps. The output is designed for auditors, compliance teams, and risk managers who need repeatable, auditable assessments.

How this skill works

For each HIPAA control the skill reads the control requirement, scans the supplied document for exact text matches, and extracts direct quotes with section references as evidence. It evaluates coverage depth against the control’s sub-requirements, classifies the finding as covered/partial/gap, assigns a confidence score, and generates targeted recommendations and reasoning. The skill enforces a conservative approach: never fabricating evidence and preferring partial when any sub-requirement is unclear.

When to use it

• Assessing policies, procedures, or technical documentation for HIPAA Security and Privacy controls
• Preparing for a HIPAA audit or internal compliance review
• Validating vendor or business associate documentation for ePHI handling
• Prioritizing remediation work by control-level gaps and confidence scores
• Creating an evidence-backed compliance roadmap for leadership

Best practices

• Provide the full, latest version of the compliance document including appendices and change logs
• Include section numbers or page references in submitted documents to enable precise evidence extraction
• Supply contextual artifacts (e.g., system configs, SOPs, training records) when available to increase confidence
• Treat addressable specifications explicitly: describe implemented alternatives or justify non-implementation
• Review and approve findings with an internal SME before taking remediation actions

Example use cases

• Run a gap analysis on an information security policy to identify missing HIPAA technical safeguards
• Evaluate a vendor’s security whitepaper to determine if encryption and access controls meet 164.312
• Compare employee training materials against 164.308 requirements and document remediation steps
• Produce an audit-ready report mapping document excerpts to specific 45 CFR citations
• Prioritize fixes by confidence score to focus on high-impact, high-uncertainty gaps