Scan Observable Controls
Enter your domain. Get an external observable control score with evidence-backed findings. Runtime controls clearly marked when internal assessment is required.
What the scanner checks
External observable controls mapped to HIPAA Security Rule requirements. Every finding includes evidence. No evidence, no claim.
Transport Encryption
Is HSTS enabled? Is TLS 1.2+ enforced? Data in transit must be encrypted.
Access Control Indicators
Are MFA indicators present? Login pages should require multi-factor authentication.
Audit Controls
Are audit logging headers present? Systems must record access to ePHI.
Integrity Controls
Are integrity headers (CSP, X-Content-Type) configured to prevent tampering?
Notice of Privacy Practices
Is an NPP present and accessible? Required for all covered entities.
Business Associate Agreements
Are BAA references visible? Required for all third-party data handlers.
Security Awareness Training
Are training program references present? Workforce must be trained.
Contingency Plan
Are disaster recovery/backup indicators present? Data must be recoverable.
Risk Analysis Evidence
Are security assessment indicators present? Risk analysis is mandatory.
HIPAA Security Rule Categories
Technical Safeguards
- ✓ Access Control
- ✓ Audit Controls
- ✓ Integrity
- ✓ Authentication
- ✓ Transmission Security
Administrative Safeguards
- ✓ Security Management
- ✓ Workforce Security
- ✓ Information Access
- ✓ Security Awareness
- ✓ Contingency Plan
Physical Safeguards
- ✓ Facility Access
- ✓ Workstation Use
- ✓ Workstation Security
- ✓ Device & Media Controls
HIPAA Penalty Tiers
Maximum annual penalty: $1.5M per violation category — OCR enforcement is active.
Important: This scanner evaluates externally observable controls against HIPAA Security Rule technical standards. Results are meaningful only for HIPAA-covered entities and business associates that handle protected health information (PHI). Runtime controls (encryption at rest, access logs, workforce training completion) require internal assessment. This tool does not determine whether an organization is subject to HIPAA.