LAUNCH CLOUD_PRO HEALTHCARE GOVERNMENT ORACLE_PRO ENTERPRISE_APPS COMMAND CENTER RECON
Tier: HEALTHCARE  |  Pricing: Contact sales  |  Agents reporting (3): baa, hipaa, phi  |  Scan date: 2026-09-20
49
Total Findings
16
Critical
25
High
8
Medium
0
Low
1
Clouds Scanned

FINDINGS (49)

CRITICALhipaaP90HPA-89AB0531

PHI stored in database without encryption at rest

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-001
PHI stored in database without encryption at rest
Encrypt PHI at rest. Customer-managed key required for safe-harbor under HIPAA Breach Notification Rule.
Proposed fix
Enable TDE / column-level encryption with CMK; rotate annually; document in Risk Assessment.
Effort: 60 min (~$145 labour) · Expected annual loss: $67,826 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: HIPAA 164.312(a)(2)(iv); HIPAA Security Rule
CRITICALhipaaP90HPA-A61B3A92

Mobile device with PHI access not encrypted (FDE)

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-009
Mobile device with PHI access not encrypted (FDE)
Full-disk encryption mandatory for any device storing or accessing PHI. Lost unencrypted device = reportable breach.
Proposed fix
MDM-enforced FDE; non-compliant device blocks PHI app access; remote-wipe enabled.
Effort: 60 min (~$145 labour) · Expected annual loss: $59,503 · Blast radius: \b(vm|instance|disk|nic|function|container)\b
Citation: HIPAA 164.312(a)(2)(iv); HHS Mobile Device Guidance
CRITICALhipaaP90HPA-383B9240

USB drive with PHI not encrypted

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-010
USB drive with PHI not encrypted
Removable media with PHI must be encrypted. Lost unencrypted USB = reportable breach (>500 = HHS publication).
Proposed fix
Endpoint policy: block unencrypted removable media; enforced via DLP / EPP.
Effort: 30 min (~$72 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.312(a)(2)(iv); HIPAA Breach Notification Rule
CRITICALhipaaP90HPA-87AA19E4

PHI stored in database without encryption at rest

Resource: HPA-001-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-001
PHI stored in database without encryption at rest
Encrypt PHI at rest. Customer-managed key required for safe-harbor under HIPAA Breach Notification Rule.
Proposed fix
Enable TDE / column-level encryption with CMK; rotate annually; document in Risk Assessment.
Effort: 60 min (~$145 labour) · Expected annual loss: $67,826 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: HIPAA 164.312(a)(2)(iv); HIPAA Security Rule
CRITICALhipaaP90HPA-6024CB44

Mobile device with PHI access not encrypted (FDE)

Resource: HPA-009-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-009
Mobile device with PHI access not encrypted (FDE)
Full-disk encryption mandatory for any device storing or accessing PHI. Lost unencrypted device = reportable breach.
Proposed fix
MDM-enforced FDE; non-compliant device blocks PHI app access; remote-wipe enabled.
Effort: 60 min (~$145 labour) · Expected annual loss: $59,503 · Blast radius: \b(vm|instance|disk|nic|function|container)\b
Citation: HIPAA 164.312(a)(2)(iv); HHS Mobile Device Guidance
CRITICALhipaaP90HPA-9833442A

USB drive with PHI not encrypted

Resource: HPA-010-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-010
USB drive with PHI not encrypted
Removable media with PHI must be encrypted. Lost unencrypted USB = reportable breach (>500 = HHS publication).
Proposed fix
Endpoint policy: block unencrypted removable media; enforced via DLP / EPP.
Effort: 30 min (~$72 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.312(a)(2)(iv); HIPAA Breach Notification Rule
CRITICALphiP90PHI-8736FEDF

PHI stored in database column without encryption

Resource: PHI-001-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-001
PHI stored in database column without encryption
Encrypt column at rest. Apply column-level encryption / TDE / Always Encrypted.
Proposed fix
ALTER TABLE encrypt column; rotate encryption key annually; document in encryption inventory
Effort: 60 min (~$145 labour) · Expected annual loss: $67,826 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: HIPAA 164.312(a)(2)(iv); 45 CFR 164.514
CRITICALphiP90PHI-D4865A44

Email containing PHI sent without TLS-required / encryption tag

Resource: PHI-011-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-011
Email containing PHI sent without TLS-required / encryption tag
Email gateway must enforce TLS to recipient domain. If recipient cannot accept TLS, use secure email portal.
Proposed fix
Mail flow rule: require TLS to known healthcare partner domains; bounce if TLS unavailable; use TLS-mandatory transport rules
Effort: 60 min (~$145 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.312(e)(1); 164.314(a)
CRITICALphiP90PHI-4DF46995

PHI stored in database column without encryption

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-001
PHI stored in database column without encryption
Encrypt column at rest. Apply column-level encryption / TDE / Always Encrypted.
Proposed fix
ALTER TABLE encrypt column; rotate encryption key annually; document in encryption inventory
Effort: 60 min (~$145 labour) · Expected annual loss: $67,826 · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: HIPAA 164.312(a)(2)(iv); 45 CFR 164.514
CRITICALphiP90PHI-FED58EBF

Email containing PHI sent without TLS-required / encryption tag

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-011
Email containing PHI sent without TLS-required / encryption tag
Email gateway must enforce TLS to recipient domain. If recipient cannot accept TLS, use secure email portal.
Proposed fix
Mail flow rule: require TLS to known healthcare partner domains; bounce if TLS unavailable; use TLS-mandatory transport rules
Effort: 60 min (~$145 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.312(e)(1); 164.314(a)
CRITICALhipaaP90HPA-C5E15973

Vendor processing PHI without Business Associate Agreement

Resource: HPA-004-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-004
Vendor processing PHI without Business Associate Agreement
PHI cannot be shared with vendor without signed BAA. BAA must include 9 specific elements per 164.504(e)(2).
Proposed fix
Block PHI sharing until BAA is on file; vendor management system tracks BAA expiry.
Effort: 60 min (~$145 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.502(e); 164.504(e)
CRITICALhipaaP90HPA-A4697E38

Terminated workforce access not removed within 24h

Resource: HPA-007-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-007
Terminated workforce access not removed within 24h
Implement termination procedures including access removal. 24h is industry SLA; same-day is best practice.
Proposed fix
HRIS-driven deprovisioning; same-day access removal; quarterly orphan-account audit.
Effort: 240 min (~$580 labour) · Expected annual loss: $80,311 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.308(a)(3)(ii)(C)
CRITICALhipaaP90HPA-4F0630FE

Breach notification not sent within 60 days of discovery

Resource: HPA-011-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-011
Breach notification not sent within 60 days of discovery
Notify affected individuals without unreasonable delay AND no later than 60 days from discovery.
Proposed fix
Incident response runbook with notification timer; comms templates pre-approved by legal.
Effort: 60 min (~$145 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.404
CRITICALphiP90PHI-8C656A59

PHI accessed by user without role-based permission (RBAC bypass)

Resource: PHI-002-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-002
PHI accessed by user without role-based permission (RBAC bypass)
Investigate access. Either add role assignment via approved process OR revoke access. Without RBAC, HIPAA minimum-necessary cannot be enforced.
Proposed fix
Apply RBAC at app layer; require role check on PHI read; audit logs must capture user+role+action
Effort: 40 min (~$97 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.312(a)(1); 164.308(a)(4)
CRITICALphiP90PHI-0DA8AFC9

PHI present in non-production environment without de-identification

Resource: PHI-004-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-004
PHI present in non-production environment without de-identification
De-identify all data going to non-prod. Apply HIPAA Safe Harbor or Expert Determination.
Proposed fix
Use Presidio / Faker for synthesis; mask 18 HIPAA identifiers; document in non-prod data flow diagram
Effort: 60 min (~$145 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.514; 45 CFR 164.514(b) Safe Harbor
CRITICALphiP90PHI-D603283A

PHI accessed by user / vendor without active Business Associate Agreement

Resource: PHI-005-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-005
PHI accessed by user / vendor without active Business Associate Agreement
Block access until BAA is executed. PHI access without BAA is a breach.
Proposed fix
Vendor mgmt: require active BAA before access provisioning; auto-revoke on BAA expiry
Effort: 60 min (~$145 labour) · Expected annual loss: $55,341 · Blast radius: single resource
Citation: HIPAA 164.314(a); 164.502(e)
HIGHhipaaP75HPA-A444E5CA

PHI in email sent without encryption / secure portal

Resource: HPA-008-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-008
PHI in email sent without encryption / secure portal
Encrypt PHI in transit. Email gateway must encrypt or block PHI; secure-portal alternatives preferred.
Proposed fix
DLP rule on outbound email; encrypt-on-detect; user training on secure portal.
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(e)(1)
HIGHhipaaP75HPA-2F5A182A

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHhipaaP75HPA-2F5A182A

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHhipaaP75HPA-92909F8C

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: HPA-003-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHbaaP75BAA-541F414B

BAA does not require encryption of PHI in transit / at rest

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-010
BAA does not require encryption of PHI in transit / at rest
Encryption is addressable but functionally required. BAA should bind BA to specific encryption standards.
Proposed fix
Add encryption clauses (AES-256 at rest, TLS 1.2+ in transit) to BAA template.
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA Security Rule 164.312(a)(2)(iv); 164.312(e)(1)
HIGHhipaaP75HPA-C288F450

PHI in email sent without encryption / secure portal

Resource: vol-083692f4e6e56f243
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-008
PHI in email sent without encryption / secure portal
Encrypt PHI in transit. Email gateway must encrypt or block PHI; secure-portal alternatives preferred.
Proposed fix
DLP rule on outbound email; encrypt-on-detect; user training on secure portal.
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(e)(1)
HIGHphiP75PHI-6220277A

PHI exported via BI / reporting tool to file or external destination

Resource: PHI-003-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-003
PHI exported via BI / reporting tool to file or external destination
Restrict export. BI dashboards on PHI must use de-identified data OR enforce export controls.
Proposed fix
BI export disabled by role; or de-identify dataset for analytics layer; log all PHI exports
Effort: 40 min (~$97 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); 164.514
HIGHhipaaP75HPA-841770F2

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: titan-proof-cui-0920160806
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHhipaaP75HPA-20A46342

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHhipaaP75HPA-AC3878F8

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: cloudtrail
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHhipaaP75HPA-20A46342

PHI audit logs not retained 6 years (HIPAA minimum)

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:54
Detector: HPA-003
PHI audit logs not retained 6 years (HIPAA minimum)
Retain audit logs of PHI access for 6 years from creation OR last effective date (whichever later).
Proposed fix
Configure log retention policy at SIEM / archive tier; quarterly retention check.
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.316(b)(2); HIPAA Security Rule
HIGHphiP75PHI-7BDD84D3

PHI captured in application error message / stack trace / log

Resource: titan-proof-cui-0920160806
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
HIGHphiP75PHI-EE42A092

PHI captured in application error message / stack trace / log

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
HIGHphiP75PHI-5CFB9765

PHI captured in application error message / stack trace / log

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
HIGHphiP75PHI-5A86F215

PHI captured in application error message / stack trace / log

Resource: cloudtrail
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
HIGHphiP75PHI-EE42A092

PHI captured in application error message / stack trace / log

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
HIGHphiP75PHI-5CFB9765

PHI captured in application error message / stack trace / log

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:56
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
HIGHhipaaP75HPA-67A93488

PHI access without minimum-necessary justification

Resource: HPA-002-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-002
PHI access without minimum-necessary justification
Minimum-necessary applies to all PHI access except treatment. Workforce members must justify access beyond their role.
Proposed fix
Role-based access; access-justification field on PHI lookup screens; quarterly access reviews.
Effort: 40 min (~$97 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.502(b); 164.514(d)
HIGHhipaaP75HPA-4D793352

Security Risk Analysis not updated in last 12 months

Resource: HPA-006-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-006
Security Risk Analysis not updated in last 12 months
Risk Analysis is the foundation of the Security Rule. Refresh annually or after major change.
Proposed fix
Annual risk analysis (NIST 800-30 method); update on major changes; document in compliance binder.
Effort: 90 min (~$218 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.308(a)(1)(ii)(A)
HIGHhipaaP75HPA-8B537688

Patient access request not fulfilled within 30 days

Resource: HPA-012-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-012
Patient access request not fulfilled within 30 days
Provide PHI to patient within 30 days (one 30-day extension permitted). Right of access is heavily enforced by OCR.
Proposed fix
Access-request intake portal; SLA dashboard; auto-escalate at day 25.
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.524
HIGHphiP75PHI-1B897608

PHI present in URL query parameters

Resource: PHI-006-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-006
PHI present in URL query parameters
URLs are logged everywhere (browser history, server logs, CDN, analytics). PHI must move to POST body or path parameter with hash.
Proposed fix
Refactor app: PHI in POST body or path with opaque ID; redact existing logs; rotate any identifiers exposed
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(e); OWASP Information Disclosure
HIGHphiP75PHI-29043F77

PHI present in cookie / session payload / JWT claim

Resource: PHI-007-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-007
PHI present in cookie / session payload / JWT claim
Cookies are exposed to client-side JS and may leak via XSS. PHI should NOT be in cookie / JWT payload.
Proposed fix
Move PHI to server-side session lookup keyed by opaque session ID; rotate session tokens
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(e)(1); OWASP A02:2021
HIGHphiP75PHI-68FAF9E2

PHI in browser local-storage / session-storage / IndexedDB

Resource: PHI-009-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-009
PHI in browser local-storage / session-storage / IndexedDB
Browser-side storage is accessible to all JS on origin. Vulnerable to XSS exfil. Move to server-side session.
Proposed fix
Refactor: only store opaque session ID client-side; PHI fetched on-demand via authenticated API
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(e); OWASP A02:2021
HIGHphiP75PHI-125E8C5E

PHI present in chat / call-center transcript / IVR recording without redaction

Resource: PHI-012-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-012
PHI present in chat / call-center transcript / IVR recording without redaction
Apply real-time redaction. Otherwise PHI flows into transcript storage.
Proposed fix
Transcription pipeline: PII redactor before save; if call-center, mute during PHI segments
Effort: 60 min (~$145 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.310(d); 164.312(b)
HIGHphiP75PHI-8B2352C0

PHI captured in application error message / stack trace / log

Resource: PHI-008-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-008
PHI captured in application error message / stack trace / log
Logs are NOT a covered application data store but DO contain PHI in this case. Sanitize logs at write time.
Proposed fix
Logging filter: redact patterns matching PHI before write; review historical logs and redact / purge
Effort: 240 min (~$580 labour) · Expected annual loss: $17,474 · Blast radius: single resource
Citation: HIPAA 164.312(b); OWASP Information Disclosure
MEDIUMbaaP55BAA-981363B0

BAA lacks covered-entity audit-right clause

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-008
BAA lacks covered-entity audit-right clause
Audit-rights enable covered entity to verify BA compliance posture. Recommended for tier-1 BAs.
Proposed fix
Add audit-rights clause to all tier-1 BAA templates; include for sub-BAAs as well.
Effort: 10 min (~$24 labour) · Expected annual loss: $314 · Blast radius: single resource
Citation: Industry best practice (not strictly required but commonly added)
MEDIUMbaaP55BAA-981363B0

BAA lacks covered-entity audit-right clause

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-008
BAA lacks covered-entity audit-right clause
Audit-rights enable covered entity to verify BA compliance posture. Recommended for tier-1 BAs.
Proposed fix
Add audit-rights clause to all tier-1 BAA templates; include for sub-BAAs as well.
Effort: 10 min (~$24 labour) · Expected annual loss: $314 · Blast radius: single resource
Citation: Industry best practice (not strictly required but commonly added)
MEDIUMbaaP55BAA-E23DFAE5

BAA lacks covered-entity audit-right clause

Resource: titan-proof-cui-0920160806
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-008
BAA lacks covered-entity audit-right clause
Audit-rights enable covered entity to verify BA compliance posture. Recommended for tier-1 BAs.
Proposed fix
Add audit-rights clause to all tier-1 BAA templates; include for sub-BAAs as well.
Effort: 10 min (~$24 labour) · Expected annual loss: $314 · Blast radius: single resource
Citation: Industry best practice (not strictly required but commonly added)
MEDIUMbaaP55BAA-90404B99

BAA lacks covered-entity audit-right clause

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-008
BAA lacks covered-entity audit-right clause
Audit-rights enable covered entity to verify BA compliance posture. Recommended for tier-1 BAs.
Proposed fix
Add audit-rights clause to all tier-1 BAA templates; include for sub-BAAs as well.
Effort: 10 min (~$24 labour) · Expected annual loss: $314 · Blast radius: single resource
Citation: Industry best practice (not strictly required but commonly added)
MEDIUMbaaP55BAA-5C96244E

BAA lacks covered-entity audit-right clause

Resource: cloudtrail
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-008
BAA lacks covered-entity audit-right clause
Audit-rights enable covered entity to verify BA compliance posture. Recommended for tier-1 BAs.
Proposed fix
Add audit-rights clause to all tier-1 BAA templates; include for sub-BAAs as well.
Effort: 10 min (~$24 labour) · Expected annual loss: $314 · Blast radius: single resource
Citation: Industry best practice (not strictly required but commonly added)
MEDIUMbaaP55BAA-90404B99

BAA lacks covered-entity audit-right clause

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:51
Detector: BAA-008
BAA lacks covered-entity audit-right clause
Audit-rights enable covered entity to verify BA compliance posture. Recommended for tier-1 BAs.
Proposed fix
Add audit-rights clause to all tier-1 BAA templates; include for sub-BAAs as well.
Effort: 10 min (~$24 labour) · Expected annual loss: $314 · Blast radius: single resource
Citation: Industry best practice (not strictly required but commonly added)
MEDIUMphiP55PHI-F42DBFDB

PHI captured in support session screen-share / video / screenshot

Resource: PHI-010-target
UNCLASSIFIED · 2026-09-20 21:29:17
Detector: PHI-010
PHI captured in support session screen-share / video / screenshot
Disable PHI display in support tools OR enable automatic redaction. Otherwise PHI flows into recording archives.
Proposed fix
Support tool: enable PII redaction; train agents to use de-identified test data when sharing screen
Effort: 10 min (~$24 labour) · Expected annual loss: $5,139 · Blast radius: single resource
Citation: HIPAA 164.310(d)
MEDIUMhipaaP55HPA-57A55350

Workforce HIPAA training not completed in last 12 months

Resource: HPA-005-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: HPA-005
Workforce HIPAA training not completed in last 12 months
Train workforce on Privacy + Security policies. Document training completion. Annual refresh recommended.
Proposed fix
Mandatory annual HIPAA training; LMS tracks completion; auto-suspend access if 90 days overdue.
Effort: 240 min (~$580 labour) · Expected annual loss: $5,139 · Blast radius: single resource
Citation: HIPAA 164.530(b)
TITAN AI - HEALTHCARE tier live proof - generated 2026-09-20
All 49 findings auto-forwarded to Jira (Incident + Change Request tables)
titanaisec.com