security-hipaa

What problem does it solve?

Implement HIPAA-aligned security, privacy, and compliance controls for a local-first transcription/OCR + form-filling app. Use when designing threat model, data handling, encryption, audit logging, access control, retention, and safe model execution.

Core Features & Use Cases

• Threat modeling and data classification: Classify all inputs/outputs as PHI by default and identify attack surfaces.
• Local-first guarantees: Ensure on-device processing for OCR, transcription, and LLM extraction with explicit user opt-in before network egress.
• Encryption and secrets: Encrypt at rest for local DB, attachments, and derived text; use OS keystore keys when available.
• Access control: Implement role-based access with automatic lock on idle and protected exports.
• Audit logging: Log who processed what, when, and export events; avoid logging raw PHI in plaintext.
• Retention and deletion: Provide configurable retention windows and secure deletion for attachments.
• Model safety: Pin model hashes, verify downloads, and sandbox inference when possible.

Quick Start

Configure HIPAA-compliant security for a local-first transcription app to ensure on-device processing, encrypted storage, and auditable access.