Compliance Framework

HIPAA Security Rule — built into the code.

Healthcare organizations building software that handles ePHI need HIPAA controls enforced where violations actually happen: in the code. MergeGuide maps the HIPAA Security Rule to code-level detection patterns that enforce at every development touchpoint.

HIPAA + SOC 2: the common stack

Most healthcare software companies are running both HIPAA and SOC 2. The Security Rule overlaps significantly with SOC 2's TSC — but with stricter requirements on certain controls.

This is where PolicyMerge shines: it resolves the conflicts automatically. HIPAA requires audit logging for all access to ePHI. SOC 2 requires access logging. PolicyMerge selects the HIPAA requirement — which is stricter — and applies it uniformly. One policy set, no gaps.

Code-only analysis: MergeGuide processes source code only — never patient data. Every analysis artifact contains code patterns and policy findings, not ePHI. Your patient data stays in your environment.

Security Rule coverage

MergeGuide templates cover all applicable HIPAA Security Rule standards with code-level controls:

  • §164.312(a)(1) — Access control: unique user identification, automatic logoff
  • §164.312(a)(2)(iv) — Encryption and decryption of ePHI
  • §164.312(b) — Audit controls: activity in information systems
  • §164.312(c)(1) — Integrity: ePHI not improperly altered or destroyed
  • §164.312(d) — Person or entity authentication
  • §164.312(e)(1) — Transmission security: guards against unauthorized ePHI access
  • §164.312(e)(2)(ii) — Encryption of ePHI in transit

HIPAA-specific detection patterns

Security Rule Standard What MergeGuide Detects Severity
§164.312(a)(2)(iv)ePHI fields stored without encryption in database schemas and ORMsCritical
§164.312(e)(2)(ii)ePHI transmitted without TLS or over deprecated protocols (TLS 1.0/1.1)Critical
§164.312(b)Audit logging disabled or missing for ePHI access functionsHigh
§164.312(a)(1)Hardcoded credentials granting ePHI accessCritical
§164.312(a)(1)Missing session timeout in ePHI-handling applicationsHigh
§164.312(c)(1)ePHI written to unprotected log files or debug outputHigh
§164.312(d)Authentication bypass patterns in healthcare API endpointsCritical
§164.312(e)(1)ePHI in query parameters (exposed in server logs and browser history)High
🔐

Encryption enforcement

MergeGuide detects when code handles ePHI fields without appropriate encryption — in database schemas, API serializers, file writes, and log statements.

📋

Audit trail generation

Every policy evaluation on ePHI-handling code generates an immutable evidence artifact. Combined with your application audit logs, this creates a complete picture for HHS auditors.

📄

Continuous evidence generation

Every PR Gate evaluation on ePHI-handling code generates an immutable, timestamped evidence artifact mapped to the specific HIPAA Security Rule standard being enforced. Audit preparation is continuous — not a scramble when HHS arrives.

Building healthcare software?

See how MergeGuide handles the intersection of HIPAA, SOC 2, and your custom ePHI handling requirements in a live demo.

Book a demo Talk to sales