Enterprise
HIPAA evidence for your database, in one report .
One command runs security coverage, checks every audit log, and maps the results to the HIPAA Security Rule.
Is each data change recorded, and where
Can a client role alter, erase or forge the audit record
Who can reach which rows, per table and role
Stamped, with a SHA-256 digest of every source
What it checks
Derived from passing tests and the catalog, never guessed.
PHI discovery. Which tables and columns hold PHI, found automatically and correctable in one fileAccess control. Row policies, owner-run code, column grants, PII in errorsAudit controls. Whether each INSERT, UPDATE and DELETE leaves an audit rowIntegrity. Which client role can edit, erase or forge audit rowsTrigger side effects. Triggers that rewrite, delete or re-route the rows they fire onAuthentication. The identity your row policies trust, and whether a session can change itpgaudit. Where it is active, which statements it logs per client role
The audit-log check
The one check security coverage alone does not make. One row per table, one cell per event.
Recorded only when every passing test that made the change saw an audit row
Conditional when a gate decides, and the gate is named
Cancelled when the trigger stops the change itself
Untested when no passing test made the change
Names what the audit table lacks, such as actor, time or old values
Each audit table judged tamper-proof, editable, forgeable or unreachable
Catches audit rows forged through a SECURITY DEFINER function any role may call
Flags audit triggers that error for callers without INSERT on the audit table
Correct what it detects
Corrections to what the tool detects go in a single file, unitautogen.toml, kept in the folder the command is run from.
Add PHI tables and columns the tool missed
Add or remove audit tables
Name the audit table each table must log to, checked on every run
Mark a table as holding no PHI, its findings stay visible
Everything taken from the file is labelled "from config file"
The file's SHA-256 is part of the evidence stamp
The config file →
The HIPAA report
A standalone document. Contents first, then numbered chapters, each opening with a short summary.
The database URL goes in the DATABASE_URL environment variable. There is no command-line flag for it.
export DATABASE_URL=postgresql://user:pass@host:5432/mydb
unitautogen hipaa --schema publicOn Windows PowerShell, set it with $env:DATABASE_URL="postgresql://user:pass@host:5432/mydb". The standard PG* variables work too. Connecting →
Summary, safeguard by safeguard
What to fix, every gap ranked with the change that closes it
Links to the security, RLS, column and PII reports it draws on
Written to <out>/hipaa/<schema>/hipaa_report.html, JSON alongside
Evidence stamp with database, DB clock, connection role, tool version and licence
SHA-256 of the report and each source, so an edited copy no longer matches
On Supabase, run unitautogen --supabase hipaa --schema public from your project. It connects to the local Supabase database itself.
Mapped to the Security Rule
Each safeguard is marked evidence or partial, with where in the report to look.
164.312(a)(1) Access control164.312(b) Audit controls164.312(c)(1) Integrity164.312(d) Person or entity authentication164.308(a)(8) Evaluation, re-runnable on demand or in CI
Evidence, not a certificate
Evidence produced does not mean a safeguard is satisfied
Activity review, encryption and transmission are listed as not covered
A tool, never a certification or an audit service
Your privacy
We would like to log your visit to see how the site is used. That records the page, the site you came from, your IP address and browser, and a random id for this tab. We delete it once we no longer need it.
Accept
Decline
