{
  "markdown": "<div align=\"center\">\n\n<img src=\"assets/logo.svg\" alt=\"hipaalint\" height=\"56\">\n\n<br><br>\n\n**Review healthcare code for potential HIPAA-related issues.**\n\n[![npm version](https://img.shields.io/npm/v/%40hipaalint%2Fai.svg)](https://www.npmjs.com/package/@hipaalint/ai)\n[![CI](https://github.com/shivyadavus/hipaalint/actions/workflows/ci.yml/badge.svg)](https://github.com/shivyadavus/hipaalint/actions/workflows/ci.yml)\n[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![TypeScript](https://img.shields.io/badge/TypeScript-5.7-blue.svg)](https://www.typescriptlang.org/)\n[![Node.js](https://img.shields.io/badge/Node.js-18%2B-green.svg)](https://nodejs.org/)\n\n_PHI detection, risk scoring, auto-remediation, and audit reports — for local review in your terminal, AI coding agent, or CI/CD pipeline. Informational only; not legal advice or compliance certification._\n\n</div>\n\n---\n\n## Why HipaaLint?\n\nHealthcare and health-adjacent codebases can accidentally expose PHI, use insecure transport, or miss basic access-control and audit-logging safeguards. AI-assisted development can increase that risk if generated code is merged without focused review.\n\nHipaaLint is a local static-analysis tool that scans your codebase against **266 rules across HIPAA, HITRUST CSF, and SOC 2 Health**, produces a 0-100 risk-oriented score, and auto-fixes a limited set of simple violations in the CLI and editor integrations.\n\nIt is designed to help teams review code and prioritize remediation. It does **not** guarantee compliance, provide legal advice, or replace formal legal, privacy, security, or compliance review.\n\n## Quick Start\n\n```bash\n# Install\nnpm install -g @hipaalint/ai\n\n# Scan your project\nhipaalint scan .\n\n# Get your compliance score\nhipaalint score .\n\n# Auto-fix simple violations\nhipaalint scan . --fix --dry-run    # preview first\nhipaalint scan . --fix              # apply fixes\n\n# Generate a PDF audit report\nhipaalint report . --format pdf\n```\n\n---\n\n## See It In Action\n\n### HipaaLint Web API & Playground\n\nIntegrate our powerful detection engine into your own web interfaces, or use our standalone interactive playground to audit compliance in real-time.\n\n<video src=\"./demo/demo.mp4\" width=\"100%\" controls autoplay loop muted></video>\n\n### HipaaLint Terminal CLI\n\nScan your entire codebase, calculate your compliance score, and auto-fix violations directly from your terminal workflow.\n\n<img src=\"./demo.gif\" width=\"100%\" />\n\n### 1. Scan — Find violations instantly\n\n```bash\nhipaalint scan ./src\n```\n\n```\n🛡️  HipaaLint AI — Scanning...\n\n   Path: ./src\n   Framework: hipaa\n   Sensitivity: balanced\n\n📊 Results:\n   Files scanned: 128\n   Rules evaluated: 266\n   Duration: 869ms\n\n   🔴 Critical: 31\n   🟠 High:     1502\n   🟡 Medium:   199\n   🔵 Low:      0\n\n🔴 HIPAA-ENC-001: Unencrypted HTTP Usage\n   📍 src/api/client.ts:15\n   📋 45 CFR §164.312(e)(1) — Transmission Security\n   💡 Use https:// for all data transmission. Configure TLS 1.2+ minimum.\n\n🔴 HIPAA-ENC-004: Hardcoded Encryption Key\n   📍 src/config/secrets.ts:40\n   📋 45 CFR §164.312(a)(2)(iv) — Encryption and Decryption\n   💡 Use environment variables or a secrets manager.\n```\n\nEvery finding includes the **HIPAA citation**, **file location**, and **actionable remediation**.\n\n### 2. Score — Quantify your compliance posture\n\n```bash\nhipaalint score ./src\n```\n\n```\n🛡️  HipaaLint Score\n\n   🔴 Overall: 3.7/100 (critical)\n\n   Domain Breakdown:\n   🟠 phi Protection:  0/100   (25% weight)\n   🟠 encryption:      0/100   (20% weight)\n   🟠 access Control:  0/100   (20% weight)\n   🟠 audit Logging:   0/100   (15% weight)\n   🟠 infrastructure:  0/100   (10% weight)\n   🟠 ai Governance:   37/100  (10% weight)\n```\n\n| Band              | Score  | Meaning                                   |\n| ----------------- | ------ | ----------------------------------------- |\n| Strong            | 90-100 | Meets baseline HIPAA technical safeguards |\n| Needs Improvement | 70-89  | Minor gaps to address                     |\n| At Risk           | 40-69  | Significant compliance gaps               |\n| Critical          | 0-39   | Immediate remediation required            |\n\nCritical violations automatically clamp the score — exposed PHI caps you at 69, no encryption caps at 59.\n\n### 3. Fix — Auto-remediate simple violations\n\n```bash\nhipaalint scan ./src --fix --dry-run\n```\n\n```\n🔧 Dry Run — 6 fix(es) would be applied:\n\n   ✅ HIPAA-ENC-001 — src/api/tests/conftest.py:16\n      Upgraded http:// to https://\n      - return AsyncClient(transport=transport, base_url=\"http://test\")\n      + return AsyncClient(transport=transport, base_url=\"https://test\")\n\n   ✅ HIPAA-ENC-001 — src/api/tests/test_auth.py:15\n      Upgraded http:// to https://\n      - return AsyncClient(transport=transport, base_url=\"http://test\")\n      + return AsyncClient(transport=transport, base_url=\"https://test\")\n\n   ℹ️  1,726 finding(s) require manual remediation (no auto-fix)\n```\n\n| Rule          | What it fixes    | Transform                                    |\n| ------------- | ---------------- | -------------------------------------------- |\n| HIPAA-ENC-001 | Unencrypted HTTP | `http://` → `https://` (preserves localhost) |\n| HIPAA-ENC-005 | Weak TLS/SSL     | `TLSv1_0` / `SSLv3` → `TLSv1_2`              |\n| HIPAA-INF-001 | CORS wildcard    | `origin: \"*\"` → `process.env.CORS_ORIGIN`    |\n\nThe `--dry-run` flag previews every change with a diff before touching any file.\n\n---\n\n## Features\n\n| Feature                  | Description                                                                                                |\n| ------------------------ | ---------------------------------------------------------------------------------------------------------- |\n| **PHI Detection**        | Detects all 18 HIPAA identifiers (SSN, DOB, MRN, email, phone, etc.)                                       |\n| **HipaaLint Score**      | Weighted 0-100 score across 6 compliance domains                                                           |\n| **Auto-Fix**             | Safe, deterministic fixes for HTTP, TLS, and CORS violations                                               |\n| **266 Compliance Rules** | Pre-seeded HIPAA, HITRUST CSF, and SOC 2 Health catalogs with semantic, regex, config, and import patterns |\n| **Audit Reports**        | JSON, SARIF (GitHub Code Scanning), and PDF reports                                                        |\n| **MCP Server**           | 5 tools for Claude Code, Cursor, and other AI agents                                                       |\n| **VS Code Extension**    | Inline diagnostics, quick fixes, dashboard sidebar, and status bar score updates                           |\n| **JetBrains Plugin**     | IntelliJ/WebStorm inspections, quick fixes, tool window dashboard, and project settings                    |\n| **GitHub Action**        | CI/CD integration with SARIF upload and score thresholds                                                   |\n| **Pre-Commit Hook**      | Block commits with critical HIPAA violations                                                               |\n| **Score Badge**          | shields.io badge for your README                                                                           |\n\n## Editor Integrations\n\n### VS Code\n\nThe repository ships a full VS Code extension in `vscode-extension/` with:\n\n- inline diagnostics for HIPAA, HITRUST, and SOC 2 findings\n- quick fixes for insecure HTTP, weak TLS, and wildcard CORS\n- a compliance dashboard sidebar\n- a status bar score badge\n- `.hipaalintrc` and workspace settings integration\n\nBuild and package it from the repo root:\n\n```bash\nnpm run vscode:package\n```\n\n### JetBrains\n\nThe repository also ships a JetBrains plugin in `jetbrains-plugin/` with:\n\n- local inspections for JavaScript, TypeScript, Python, and Java files\n- quick-fix intentions for the same auto-fixable transport rules\n- a tool-window dashboard powered by the HipaaLint CLI\n- project settings for framework, sensitivity, config path, and CLI path\n\nBuild it with Gradle and JDK 21:\n\n```bash\nnpm run jetbrains:build\n```\n\n## Claude Code Plugin\n\nInstall HipaaLint as a Claude Code plugin directly from this repository:\n\n```bash\nclaude plugin install https://github.com/shivyadavus/hipaalint\n```\n\nThe plugin bundles:\n\n- 6 Claude skills in `skills/`\n- 1 compliance review agent in `agents/`\n- a local MCP server exposing 5 compliance tools via `.mcp.json`\n\nBefore submitting the repo to the Claude marketplace, validate both manifests locally:\n\n```bash\nclaude plugin validate .claude-plugin/plugin.json\nclaude plugin validate .claude-plugin/marketplace.json\n```\n\n## Release Readiness\n\nRun the full local release gate before cutting a tag:\n\n```bash\nnpm run verify:release\n```\n\nSynchronize the version across npm, Claude plugin metadata, VS Code, and JetBrains before tagging:\n\n```bash\nnpm run release:prepare -- patch\n```\n\nThe mutable rule database now defaults to a user-writable application data directory. Set `HIPAALINT_DB_PATH` if you need to pin it explicitly for CI, sandboxes, or editor integrations.\n\n## The 6 Compliance Domains\n\n| Domain             | Weight | What It Checks                                           |\n| ------------------ | ------ | -------------------------------------------------------- |\n| **PHI Protection** | 25%    | PHI in source code, logs, error handlers, API responses  |\n| **Encryption**     | 20%    | TLS/HTTPS enforcement, strong hashing, no hardcoded keys |\n| **Access Control** | 20%    | Auth middleware, RBAC, session timeout, MFA              |\n| **Audit Logging**  | 15%    | Structured audit trails, log retention, PHI scrubbing    |\n| **Infrastructure** | 10%    | CORS security, security headers, rate limiting           |\n| **AI Governance**  | 10%    | PHI scrubbing for AI prompts, model input sanitization   |\n\n---\n\n## CLI Commands\n\n### `hipaalint scan [path]`\n\nScan a project for HIPAA violations:\n\n```bash\nhipaalint scan ./src --sensitivity strict\nhipaalint scan ./src --fix              # auto-fix simple violations\nhipaalint scan ./src --fix --dry-run    # preview fixes without writing\nhipaalint scan ./src --json             # machine-readable output\nhipaalint scan ./src --sarif            # GitHub Code Scanning format\n```\n\n### `hipaalint score [path]`\n\nCalculate the HipaaLint Score:\n\n```bash\nhipaalint score .                    # display score\nhipaalint score . --threshold 80     # fail CI if below 80\nhipaalint score . --json             # machine-readable output\n```\n\n### `hipaalint report [path]`\n\nGenerate audit reports:\n\n```bash\nhipaalint report . --format pdf --output ./reports\nhipaalint report . --format sarif    # for GitHub Code Scanning\nhipaalint report . --format json     # structured JSON report\n```\n\n### `hipaalint phi <file>`\n\nDetect PHI in a specific file:\n\n```bash\nhipaalint phi ./src/api/patients.ts\n```\n\n### `hipaalint rules`\n\nBrowse the rule database:\n\n```bash\nhipaalint rules --category phi_protection --severity critical\nhipaalint rules --query \"encryption\" --json\n```\n\n---\n\n## AI Agent Integration (MCP)\n\nHipaaLint runs as an MCP server, giving AI coding agents 5 compliance tools:\n\n```json\n{\n  \"mcpServers\": {\n    \"hipaalint-ai\": {\n      \"command\": \"node\",\n      \"args\": [\"node_modules/@hipaalint/ai/dist/mcp-server/index.js\"]\n    }\n  }\n}\n```\n\n**Available Tools:**\n\n- `compliance_scan` — Scan project for violations\n- `compliance_score` — Calculate compliance score\n- `compliance_report` — Generate audit reports (JSON/PDF)\n- `phi_detect` — Detect PHI in code snippets\n- `compliance_rules` — Search and browse the rule database\n\n**Slash Commands:**\n\n- `/compliance:scan` — Run a compliance scan\n- `/compliance:report` — Generate an audit report\n\n## GitHub Action\n\n```yaml\n# .github/workflows/compliance.yml\nname: Compliance Check\non: [push, pull_request]\n\njobs:\n  hipaa:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: shivyadavus/hipaalint@v1\n        with:\n          threshold: 70\n          sensitivity: balanced\n          upload-sarif: true\n```\n\n## Pre-Commit Hook\n\n```bash\ncp node_modules/@hipaalint/ai/hooks/pre-commit .git/hooks/\nchmod +x .git/hooks/pre-commit\n```\n\nBlocks commits with critical HIPAA violations. Warns on high-severity findings.\n\n## Score Badge\n\nAdd to your README:\n\n```markdown\n[![HipaaLint Score](https://img.shields.io/badge/HipaaLint-92%2F100-00c853?style=for-the-badge)](https://github.com/your-org/your-repo)\n```\n\n---\n\n## Architecture\n\n```\nsrc/\n├── engine/                # Core analysis engine\n│   ├── types.ts           # Zod-validated type system\n│   ├── phi-detector.ts    # 18 HIPAA identifier detectors\n│   ├── rule-evaluator.ts  # Pattern matching (5 pattern types)\n│   ├── score-calculator.ts # Weighted scoring algorithm\n│   ├── auto-fixer.ts      # Auto-remediation engine\n│   └── regex-cache.ts     # Compiled regex cache for performance\n├── rules/                 # Rule database\n│   └── db/                # SQLite schema + HIPAA/HITRUST/SOC2 rule catalogs\n├── mcp-server/            # MCP server (5 tools)\n├── cli/                   # CLI entry point (commander.js)\n├── reports/               # JSON, SARIF, PDF generators\n└── security/              # Input validation, path safety, ReDoS guards\n```\n\n## Supported PHI Types (18 HIPAA Identifiers)\n\nNames, SSN, DOB, Addresses, Phone Numbers, Email, Medical Record Numbers, Health Plan IDs, Account Numbers, Certificate/License Numbers, Vehicle Identifiers, Device IDs, Web URLs, IP Addresses, Biometric IDs, Photos, Geographic Data (ZIP codes), and Dates.\n\nAll mapped to specific provisions under **45 CFR §164.514(b)(2)**.\n\n## Contributing\n\nContributions are welcome! See [CONTRIBUTING.md](./CONTRIBUTING.md) to get started and [AGENTS.md](./AGENTS.md) for coding standards.\n\n## Support the Project\n\nIf HipaaLint helps you review healthcare-related code more safely, please consider giving the repo a star. It helps others discover the project and motivates continued development.\n\n[![GitHub stars](https://img.shields.io/github/stars/shivyadavus/hipaalint?style=social)](https://github.com/shivyadavus/hipaalint)\n\n## License\n\nApache-2.0 &copy; Shiv Yadav\n\n---\n\n### Disclaimer\n\n**HipaaLint AI is a static analysis tool designed to assist in identifying potential PHI exposure and enforcing security best practices. It does NOT guarantee HIPAA, HITRUST, SOC 2, GDPR, or CCPA compliance and does NOT constitute legal advice.**\n\nThis software is provided \"AS IS\", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages, or other liability arising from the use of this software. The generated reports and compliance scores are for informational purposes only and should not be construed as legal, regulatory, or compliance advice.\n\nUse of HipaaLint does not create a professional services relationship, compliance certification, or legal advisory engagement of any kind. Ultimate responsibility for compliance and data security remains with the developers, organizations, and covered entities using this software.\n\nAlways consult with qualified legal and compliance professionals. See the full [Apache 2.0 License](./LICENSE) for complete warranty disclaimer and limitation of liability terms.\n",
  "bytes": 15456,
  "sha": "48434350884e5049043667f73ee65544308a890db787dd5a228bdf2d3e44c38f",
  "repo_slug": "shivyadavus/hipaalint",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_shivyadavus_hipaalint_hipaalint_ai_11ce24e6/readme"
}