Risk analysis generated from infrastructure scans, not spreadsheets. 100% of technical safeguards covered by automated checks. Assessment-ready in weeks.
Every HIPAA technical safeguard requirement has at least one automated check. Most have three or more.
Infrastructure scanning, risk analysis, and evidence collection in a single automated pipeline.
Prowler scans your AWS environment against 292 HIPAA-mapped checks covering §164.312 technical safeguards. Exposure evidence collected from breach databases, Shodan, and certificate transparency logs.
NIST SP 800-30 Rev 1 risk assessment maps every finding to threat sources, calculates likelihood and impact, and produces a prioritized risk register with 30/60/90-day treatment timelines.
OSCAL assessment results, risk register, treatment plan, and POA&M exported as machine-readable JSON and human-readable markdown. SHA256-signed evidence chain from scan to deliverable.
Your §164.308(a)(1)(ii)(A) risk analysis generated from real infrastructure data, not a questionnaire.
External exposure evidence mapped to HIPAA safeguard requirements. Breach intelligence informs your risk register, not a separate silo.
HIBP, LeakCheck, and Dehashed feeds detect exposed credentials tied to your domain. Auto-escalated to CRITICAL risk with 30-day remediation timeline.
§164.312(d) · Person or Entity AuthenticationShodan and certificate transparency logs map exposed services and TLS certificates. Unencrypted ePHI transmission paths flagged automatically.
§164.312(e)(1) · Transmission SecurityDNSTwist identifies typosquat and homoglyph domains targeting your brand. Catches phishing infrastructure before credential harvesting begins.
§164.308(a)(5)(ii)(B) · Protection from Malicious SoftwareFIRST EPSS probability scores and CISA KEV catalog focus remediation on vulnerabilities with known exploitation. Risk-ranked, not CVSS-ranked.
§164.308(a)(1)(ii)(A) · Risk AnalysisHHS Health Sector Cybersecurity Coordination Center (HC3) advisories mapped to your HIPAA safeguard gaps. Healthcare-specific threat intelligence.
§164.308(a)(1)(ii)(B) · Risk ManagementEvery exposure finding maps to a specific HIPAA CFR citation with automated check IDs. No manual cross-referencing needed.
§164.312(b) · Audit ControlsSOCFortress CoPilot deployed inside your environment for continuous ePHI access monitoring, incident response, and audit evidence.
Defense contractors handling both CUI and ePHI get a single scan that covers both frameworks. One pipeline, two compliance stories.
110 controls, 320 assessment objectives. SPRS scoring, C3PAO-ready OSCAL artifacts, and SSP-as-code pipeline.
32 requirements, NIST SP 800-30 risk analysis, exposure evidence, and ePHI boundary monitoring.
$ run-scan.sh --framework dual --profile client-prod
Every engagement begins with scanning your actual infrastructure. No questionnaires.
We scan your AWS environment against HIPAA technical safeguards, run exposure evidence collection, and generate a NIST SP 800-30 risk register. No questionnaires, no NDAs required for the initial scan.