Control map · 45 CFR Part 164

HIPAA

Code evidence for the technical safeguards and the Privacy Rule’s use and disclosure requirements, where they live in code.

Book an audit pilot See a sample report

HIPAA · 45 CFR Part 1648 requirements in scope · as mapped in v1.4.1

Code 7
Process 0
Planned 1

Code evidence

7requirements checked on every pull request

Live (process)

0none mapped

Planned

1can be evidenced from code or GitHub; not built yet

Organisation-level requirements

Policies, people, vendors, physical security and the like, listed below.Toevan gives supporting evidence for 2 of these.Managed by your organisation’s workflows

The Security Rule’s technical safeguards and parts of the Privacy Rule are visible in code: access control, integrity, authentication, transmission security and how protected health information is used and disclosed.

The HIPAA blueprint gives code evidence for these on every pull request. Administrative and physical safeguards stay with your programme.

Toevan gives evidence for controls; it never certifies them or claims a framework is covered. Whether the evidence is sufficient is your auditor’s judgement.

Code evidence7

Sealed on every pull request. Always partial: the control also asks for things outside code. Rules in the HIPAA blueprint check part of each on every pull request.

164.308(a)(4)Information access management164.308 Administrative safeguards
164.312(a)(1)Access control164.312 Technical safeguards
164.312(c)(1)Integrity164.312 Technical safeguards
164.312(d)Person or entity authentication164.312 Technical safeguards
164.312(e)(1)Transmission security164.312 Technical safeguards
164.502Uses and disclosures of protected health information: General rulesPrivacy Rule
164.514Other requirements relating to uses and disclosures of protected health informationPrivacy Rule

Supporting2

Toevan records related evidence, but the duty is organisational, so it never counts as covered.

164.310(d)(1)Device and media controls164.310 Physical safeguardsSupporting evidence: a rule records evidence related to this duty. The duty itself is physical security.
164.504Uses and disclosures: Organizational requirementsPrivacy RuleSupporting evidence: a rule records evidence related to this duty. The duty itself is contracts and vendors.

Planned1

Can be evidenced from code or GitHub. No rule checks these yet; each is planned, and none counts as evidence today.

164.312(b)Audit controls164.312 Technical safeguards

Organisation-level requirements

Organisation-level controls (policies, people, vendors, physical security and the like) stay with your organisation’s own process; Toevan does not cover them.

Show the list

164.308 Administrative safeguards

164.308(a)(1)Security management processan operational process

164.308(a)(2)Assigned security responsibilityorganisational policy

164.308(a)(3)Workforce securitypeople and HR

164.308(a)(5)Security awareness and trainingpeople and HR

164.308(a)(6)Security incident proceduresan operational process

164.308(a)(7)Contingency planan operational process

164.308(a)(8)Evaluationan external assessment

164.308(b)(1)Business associate contracts and other arrangementscontracts and vendors

164.310 Physical safeguards

164.310(a)(1)Facility access controlsphysical security

164.310(b)Workstation useorganisational policy

164.310(c)Workstation securityphysical security

164.314 Organizational requirements

164.314(a)(1)Business associate contracts or other arrangementscontracts and vendors

164.314(b)(1)Requirements for group health planscontracts and vendors

164.316 Policies and procedures and documentation requirements

164.316(a)Policies and proceduresorganisational policy

164.316(b)(1)Documentationorganisational policy

Breach Notification Rule

164.404Notification to individualsregulatory procedure

164.406Notification to the mediaregulatory procedure

164.408Notification to the Secretaryregulatory procedure

164.410Notification by a business associateregulatory procedure

164.412Law enforcement delayregulatory procedure

164.414Administrative requirements and burden of proofregulatory procedure

Privacy Rule

164.506Uses and disclosures to carry out treatment, payment, or health care operationsorganisational policy

164.508Uses and disclosures for which an authorization is requiredorganisational policy

164.509Uses and disclosures for which an attestation is requiredorganisational policy

164.510Uses and disclosures requiring an opportunity for the individual to agree or to objectorganisational policy

164.512Uses and disclosures for which an authorization or opportunity to agree or object is not requiredorganisational policy

164.520Notice of privacy practices for protected health informationorganisational policy

164.522Rights to request privacy protection for protected health informationorganisational policy

164.524Access of individuals to protected health informationan operational process

164.526Amendment of protected health informationan operational process

164.528Accounting of disclosures of protected health informationorganisational policy

164.530Administrative requirementsorganisational policy

Using it in an audit

Read the code evidence for the period
Each pull request carries sealed code results against the blueprint’s rules, pinned to the commit and the rule-set version in force.
Test a sample
For each sampled record, check its results, then verify it offline against the published key with openssl and the shell: get the evidence, confirm the key, check the record. To replay the whole chain, Toevan provides the toevan command on request; it is not yet public.
The three steps, with the exact commands

How each fact was obtained6 labels

Recomputed: Toevan computed it from the code or git history itself.
Reported + sealed: GitHub reported it; Toevan captured it at the event and signed it.
Declared + sealed: The organisation declared it, such as a change to what is checked; Toevan signed the declaration and its history.
Toevan record, not sealed: Held in Toevan’s database but not sealed in the ledger, such as a waiver today. Nothing protects it by a signature.
Consumed: Taken from GitHub’s deployment and release records and linked by commit or digest.
Not captured: No reliable source was available. Toevan does not infer it.

The sample change evidence report shows the evidence as your auditor receives it, with every fact labelled.Open the sample report

Test the mapping on a real audit.

Bring one repository and an upcoming audit. We’ll set up the blueprint and walk your auditor through verification.

Book an audit pilot See a sample report

One repository, one framework
Evidence from the first pull request
Verifiable without a Toevan account