HIPAA Hawk · for health-tech teams
28 checks. Each one cites the rule.
HIPAA Hawk is the Database Raven for teams that hold health data. Each check cites the HIPAA Security Rule section it relates to, so a reviewer can trace a finding back to the regulation. It is a scanning aid, not a certification.
#43C9F6- Checks
- 28, each built on a fixed rule.
- Cites
- 7 sections of 45 CFR Part 164.
- Runs
- First in a full inspection, in stage 01, Connect.
- Is not
- A certification. No one is “HIPAA certified”, including us.
What it cites
7 sections of the Security Rule.
Each check cites one section of 45 CFR Part 164. Most sit in the technical safeguards; risk analysis and business associate contracts sit elsewhere in the rule.
HIPAA Hawk checks per cited section
28 checksThe catalog
All 28 checks.
The check IDs and titles are the ones the product writes into findings. Severity is each check’s default.
| Check | What it finds | Default severity |
|---|---|---|
45 CFR 164.312(a)(1)Access Control14 checks | ||
HH-RLS-001 | Public table has Row Level Security disabled | High |
HH-RLS-002 | Permissive write policy (USING/WITH CHECK true) | Critical |
HH-RLS-003 | PHI-capable table missing tenant/org boundary key | Critical |
HH-RLS-004 | Permissive SELECT policy (USING true) | Critical |
HH-RLS-007 | Default privileges grant anonymous access to new objects | Critical |
HH-RLS-008 | Anonymous GRANT on tenant or PHI-named tables or views | Critical |
HH-RLS-009 | View missing security_invoker (owner-bypass) | Critical |
HH-RLS-010 | SECURITY DEFINER function executable by anonymous | Critical |
HH-RLS-011 | Anonymous write privilege on tenant or PHI-named tables | Critical |
HH-STOR-001 | Public storage bucket | High |
HH-STOR-002 | Anonymous public write to storage | Critical |
HH-STOR-003 | Public bucket name suggests PHI/ePHI | Critical |
HH-SEC-001 | Plaintext secret or credential column | High |
HH-SEC-003 | Public anon/publishable key with weak or incomplete RLS | Critical |
45 CFR 164.312(b)Audit Controls1 check | ||
HH-AUD-001 | Restricted health or identity data observed at ingest | High |
45 CFR 164.312(c)(1)Integrity2 checks | ||
HH-INT-001 | SECURITY DEFINER function missing fixed search_path | High |
HH-PG-002 | Installed extension is behind the available default version | High |
45 CFR 164.312(d)Person or Entity Authentication1 check | ||
HH-AUTH-001 | MFA coverage below HIPAA authentication baseline | High |
45 CFR 164.312(e)(1)Transmission Security2 checks | ||
HH-TX-001 | HTTPS site missing HSTS | High |
HH-PG-003 | Insecure PostgreSQL setting | High |
45 CFR 164.308(a)(1)(ii)(A)Risk Analysis5 checks | ||
HH-RLS-012 | Critical access-control finding reobserved after it was closed | Critical |
HH-COV-001 | Leak scan incomplete — probe, fixtures, or runtime stage missing | High |
HH-SEC-002 | HIPAA hawk probe functions not installed | Medium |
HH-PHI-001 | Schema contains PHI-named columns | Medium |
HH-PG-001 | PostgreSQL major version is end-of-life or nearing EOL | Critical |
45 CFR 164.314(a)(1)Business Associate Contracts3 checks | ||
HH-BAA-001 | Vendor may handle ePHI without a current signed BAA | High |
HH-BAA-002 | Business Associate Agreement is expired | High |
HH-BAA-003 | PHI-capable schema with empty vendor BAA inventory | Medium |
A few checks set their severity from what they find: an end-of-life Postgres version, for example, rates higher than one nearing its end of life.
How it works
First in line, and never a guess.
Fixed rules over what the probe reports. No AI model reads your data.
Stage 01 · ConnectIt runs first, and fails closed
In a full inspection, HIPAA Hawk confirms the probe answers before anything is judged. If it does not, HIPAA Hawk reports “Leak scan incomplete”, and the run is incomplete, never a pass.
Names and flagsIt reads names, never your rows
Its checks work from names, flags and counts: what the probe in your database reports about tables, policies, grants, buckets, settings and versions, your site’s HSTS header, and your own BAA inventory.
HH-RLS-004Read rules that let anyone in
A SELECT policy written USING (true) lets anyone who reaches the table read all of it. HIPAA Hawk finds it in the policy itself: derived from your policies, never from your rows.
HH-BAA-001 to 003Your vendor BAA inventory
Your own record of vendors and their BAA status. HIPAA Hawk flags a vendor that may handle ePHI without a current signed BAA, an expired BAA, and a health-data schema with an empty inventory. It is not a contract vault, and it does not create a BAA.
HH-AUD-001Health data at ingest
If probe telemetry looks like it carries health or identity data, ingest redacts it and HIPAA Hawk opens a finding. The raw values are not stored.
Finding · HIPAA Hawk
SampleCriticalPermissive SELECT policy (USING true)
- Check
HH-RLS-004- Table
public.members- Policy
members_read_all- Cites
45 CFR 164.312(a)(1)Access Control
A result names the table and the policy. Never your rows.
Private early access. HIPAA Hawk does not run for customers in production yet. Today, only the three Web Ravens do. Request early access
Limits
A scanning aid. Not a certification.
What HIPAA Hawk does not do, written down so you can hold us to it.
Not a certification. HHS does not recognize private HIPAA certifications, and no one is “HIPAA certified”, including us.
Not the whole rule. It maps technical gaps on the systems you connect. Safeguards that live outside those systems, such as workforce training and facility access, are not automated.
Not a BAA. Connecting a source does not create a business associate agreement.
Not a home for health data. Regulated-data connections are off in production. Do not send protected health information to Secure Raven.
Not legal advice. It does not replace your Privacy Officer, your Security Officer or your counsel.
Trace every finding to the rule.
HIPAA Hawk is in private early access. Tell us what you run, and whether your team holds health data.