Overview
A healthcare technology organization needed a way to continuously audit its growing codebase for HIPAA compliance — catching violations before they reached production. Manual code reviews were slow, inconsistent, and couldn’t keep up with the pace of development across multiple teams and repositories.
We built an AI-powered compliance scanner that analyzes codebases in real time — detecting infrastructure violations, insecure PHI handling, missing encryption, exposed credentials, and documentation gaps. Each finding is categorized by severity, mapped to specific CFR regulation references, classified by penalty tier, and paired with actionable code-level fixes. The tool supports both GitHub repositories (public and private) and local file uploads, with a full audit trail and exportable reports.
Core Features
Intelligent Codebase Scanning
Scans GitHub repositories (public and private with token authentication) or locally uploaded files. Uses Claude via AWS Bedrock to perform deep AI-powered analysis against the full 2024 HIPAA requirements — including modern cybersecurity mandates like MFA, zero-trust, cloud security, and AI/ML security.
- Real-time progress tracking during scans
- Support for GitHub repos, ZIP uploads, and code snippets
- 5,000 requests/hour with authenticated GitHub scanning
- LocalStorage fallback for offline access
Detailed Compliance Findings
Every finding includes a severity classification (Critical, High, Medium, Low), the specific file and line reference, the applicable CFR regulation (e.g., 45 CFR §164.312(a)(1)), penalty tier classification with dollar amounts, and actionable code examples demonstrating the fix.
- Infrastructure violations — VPC, security groups, encryption at rest
- Database security — public accessibility, missing backups
- Code vulnerabilities — hardcoded credentials, insecure patterns
- Compliance documentation gaps and API security issues
Reporting, Audit Trail & BAA Generator
Generates exportable compliance reports with severity breakdowns and remediation guidance. Every scan is tracked in a persistent audit history via Supabase. A built-in BAA (Business Associate Agreement) generator creates compliant templates for vendor relationships.
- Downloadable compliance reports with embedded findings
- Historical scan tracking with full audit trail
- BAA template generation for business associate relationships
- Multi-user authentication with Supabase
Architecture & Infrastructure
A full-stack serverless application with a React frontend deployed on Vercel, backed by serverless API functions that integrate AWS Bedrock for AI analysis, a Lambda-based GitHub proxy for repository access, and Supabase for authentication and data persistence.
Frontend
React 19 + TypeScript, Vite, Tailwind CSS, responsive dashboard with real-time scan progress
AI Analysis
AWS Bedrock with Claude for deep HIPAA analysis against 2024 regulatory requirements
Backend
Vercel serverless functions, AWS Lambda GitHub proxy, AWS CDK infrastructure as code
Data & Auth
Supabase for authentication and persistent storage, LocalStorage fallback, complete audit trail
Detection Categories
Infrastructure
VPC, security groups, network isolation, encryption
Database
Encryption at rest, public access, backup policies
Storage
S3 bucket encryption, public access blocks
Code Security
Hardcoded credentials, insecure patterns, PHI exposure
Authentication
MFA, zero-trust, session management, access controls
Documentation
Compliance gaps, missing policies, BAA requirements
HIPAA Penalty Tier Mapping
Every finding is classified by HIPAA penalty tier so organizations can prioritize remediation by financial and regulatory risk:
Tier 4 — Willful Neglect
$50,000+ per violation
Tier 3 — Willful Neglect (Corrected)
$10,000–$50,000 per violation
Tier 2 — Reasonable Cause
$1,000–$50,000 per violation
Tier 1 — Lack of Knowledge
$100–$50,000 per violation
Interested in a similar solution for your organization?
Request a Consultation