> ## Documentation Index
> Fetch the complete documentation index at: https://uip-f4b0bbe5.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA

> PHI handling for US healthcare workloads.

The HIPAA policy pack maps AGCMS controls to the HIPAA Security Rule
(45 CFR §164.312). Apply it during onboarding or any time from
**Settings → Policy → Apply pack → HIPAA**.

| Control                        | AGCMS feature                       | Citation       |
| ------------------------------ | ----------------------------------- | -------------- |
| Audit controls                 | HMAC-signed, hash-chained audit log | §164.312(b)    |
| Person / entity authentication | SSO + MFA, scoped API keys          | §164.312(d)    |
| Transmission security          | TLS 1.3, HMAC-signed webhooks       | §164.312(e)(1) |
| Integrity controls             | Merkle anchors to S3 Object Lock    | §164.312(c)(1) |

All PHI categories detected by the PII service (names, SSN, MRN, addresses,
phone, email, DOB) are redacted by default under this pack.