hipaa-audit

Built at HackPrinceton Fall 2025

CLI tool for running HIPAA compliance audits on codebases.

Setup

Prerequisites

To configure this CLI tool, first clone the repository and set up the backend and frontend:

# Clone the repository
git clone https://github.com/Rojan-upreti/Scanara
cd Scanara

# Run backend on localhost:5000
# (Follow the backend setup instructions in the repository)

# Run frontend on localhost:5173
# (Follow the frontend setup instructions in the repository)

Installation

npm install -g hipaa-audit

Or use locally:

npm install hipaa-audit
npx hipaa-audit

Usage

hipaa-audit

Features

• API Key Verification: Secure connection to audit service (API key is generated after creating an app in the web interface)
• Codebase Collection: Automatically collects code files from your project
• HIPAA Compliance Analysis: Comprehensive audit of your codebase
• Detailed Reporting: Color-coded results with findings and remediation plans

Configuration

Environment Variables

• HIPAA_AUDIT_API_URL: Backend API URL (default: http://localhost:5000)

Config File

Create a .hipaa-auditrc file in your home directory or project root:

For local development:

{
  "apiUrl": "http://localhost:5000",
  "apiKey": "sk_..." // Optional, not recommended for production
}

For production:

{
  "apiUrl": "https://prodpush--scanaraai.us-east4.hosted.app",
  "apiKey": "sk_..." // Optional, not recommended for production
}

Security Note: Storing API keys in config files is not recommended for production environments. Use environment variables instead.

API Key Configuration

To configure your API key:

1. Create an app in the web interface (frontend running on localhost:5173)
2. Generate your API key
3. Either:
   • Enter it when prompted by the CLI, or
   • Add it to your .hipaa-auditrc config file

Supported File Types

The tool automatically collects files with the following extensions:

• JavaScript/TypeScript: .js, .jsx, .ts, .tsx
• Python: .py
• Java: .java
• C/C++: .c, .cpp
• C#: .cs
• Go: .go
• Rust: .rs
• PHP: .php
• Ruby: .rb
• Swift: .swift
• Kotlin: .kt
• Scala: .scala
• Dart: .dart
• Vue: .vue
• Svelte: .svelte
• Files without extensions (e.g., Makefile, Dockerfile)

Excluded Directories

The following directories are automatically excluded:

• node_modules
• .git
• dist, build
• .next, .cache
• vendor
• And other common build/dependency directories

Workflow

1. Create App: First, create an app in the web interface to generate your API key
2. API Key Verification: Enter your API key to connect to the audit service (the app information is automatically retrieved)
3. Codebase Collection: The tool collects all relevant code files from your project
4. Audit Execution: Your codebase is analyzed for HIPAA compliance
5. Results Display: View compliance score, findings, and remediation plan

Output

The tool provides:

• Compliance Score: Overall score out of 100
• Status: Color-coded compliance status
  • 🟢 Green: Compliant (≥80)
  • 🟡 Yellow: Needs Attention (60-79)
  • 🔴 Red: Non-Compliant (<60)
• Summary Statistics: Breakdown by severity (Critical, High, Medium, Low)
• Top Findings: Most important issues to address
• Remediation Plan: Prioritized fixes with actionable steps

Requirements

• Node.js >= 18.0.0
• ES Modules (ESM) support

License

MIT