HIPAA technical safeguards in a Laravel codebase: what an auditor will ask to see

The HIPAA Security Rule is written in general terms, so a developer cannot read it and know what to build. What helps is a list of questions an auditor or a customer's security team will ask, and a codebase that answers each one with something you can show.

Access control

Every user has a unique ID. Permissions are role based, and where a role needs less than a whole record, they go down to the field. We write policies for every model and test them, including the negative cases, such as a front desk user trying to read clinical notes.

• Automatic logoff after inactivity, with a timeout agreed with the client.
• An emergency access path that is possible, loud and reviewed afterward.
• Short lived tokens with refresh rotation, and a way to revoke a session at once.

Audit controls

Auditors ask who accessed a patient's record in the last ninety days. If you cannot answer in a minute, the logging is not good enough. We log reads as well as writes, with the user, tenant, record, action, source address and time, and we write to an append only store that the application account cannot edit.

// Model event writes an audit row; the audit connection has insert only rights
static::retrieved(fn ($m) => Audit::record('read', $m, auth()->id()));

Integrity

Clinical notes are versioned, never overwritten. Uploaded files and images store a checksum, and a scheduled job verifies it. Database constraints reject impossible data before it reaches a chart.

Authentication

Staff sign in with multi-factor authentication. Failed attempts are rate limited and logged. Password rules follow current guidance, which means length and breach checks over forced rotation.

Transmission security

TLS 1.2 or newer everywhere, HSTS, no mixed content, signed webhooks and no PHI in URLs. Email and SMS carry neutral text, with a link into the portal where the sign-in happens.

Evidence you should keep

• The role and permission matrix, and the tests that enforce it.
• A data flow diagram showing where PHI is created, stored and sent.
• Samples of audit reports and the retention setting.
• Backup and restore test records.
• Penetration test reports and the fixes that followed.

None of this makes software HIPAA certified, because that certification does not exist. It does make the conversation with your auditor short and boring, which is the goal.