HIPAA programs
Your auditor asked for a technical evaluation
Trident tests each technical safeguard, ties every gap to a verified finding, and assembles evidence you can hand the assessor.
- Holds under test
Access control
Who can reach a PHI store
- Holds under test
Audit controls
What the record shows
- Holds under test
Integrity
Whether data can be altered
- Fails under test
Transmission security
How PHI moves between systems
One row failed its test
An integration link will carry ePHI in the clear
EntrySomeone on the networkImpactePHI readable in transit
Observed from the shared network
Attack path
How the evaluation runs
Recon
Read-only roles inventory the systems that hold or move ePHI.
Path mapping
Each safeguard maps to the paths it should close.
Exploit validation
Sanitized probes demonstrate each gap, never infer it.
Draft PR + report
The fix opens as a draft PR; the package typesets.
The evidence package, assembled
Focused on the attack surface instead?
See the path to PHIEvidence package
Each safeguard, its test, and its result — assembled as an evidence package.
- Read-only test access, scoped and expiring
- Evidence is sanitized — no ePHI is captured
- Each safeguard links to its test and its result
- Findings ship with reproduction and fix
Safeguards this evidence supports
Referenced to the Security Rule technical safeguards, without claiming to discharge them.
Security Rule
The Security Rule requires a risk analysis, technical safeguards over electronic PHI, and periodic evaluation of whether those safeguards work. Trident supports the evaluation half and produces the evidence with tracked remediation. Trident does not certify HIPAA compliance. The flaw on this page is a transmission-security failure: an integration link that will negotiate ePHI down to cleartext.
- Access control
- Whether unique user identification and role restrictions constrain what each identity retrieves, tested with separate accounts rather than inferred.
- Audit controls
- Whether access to ePHI is recorded in a way that survives an investigation, including whether the record captures who performed the read.
- Integrity
- Whether ePHI can be altered or destroyed through an unauthorized path, including indirect routes through integrations and administrative tooling.
- Transmission security
- Protection of ePHI in transit across application, API and internal service boundaries, including the internal hops left unencrypted from a trusted-network era.
- Evaluation evidence
- A periodic, documented evaluation with findings, remediation and retest — the artefact the standard asks for and most often lacks.
Questions about the Security Rule evaluation
Does Trident certify HIPAA compliance?
Do you need access to systems containing ePHI?
Is exploit validation safe around ePHI systems?
How does this differ from a HIPAA risk analysis?
Walk into the evaluation with evidence.
See an evaluation run against your estate, safeguard by safeguard.
Trident does not certify HIPAA compliance.