HIPAA Security Rule Self-Assessment

Executive Summary

AegisGate is a self-hosted, on-premises security gateway for AI infrastructure. Deployed as a Docker container on customer-controlled infrastructure, AegisGate operates with zero external dependencies and zero data exfiltration pathways. This self-assessment evaluates AegisGate’s compliance posture against the HIPAA Security Rule (45 C.F.R. §§ 164.302–318) and demonstrates that all applicable requirements are addressed through architectural controls, automated compliance enforcement, and documented policy alignment.

AegisGate’s design philosophy — customer-owned infrastructure, customer-managed encryption keys, and no cloud dependency — inherently satisfies several Security Rule requirements by eliminating the attack surface categories that cloud-hosted alternatives must explicitly mitigate. Where requirements fall outside the scope of a software product (e.g., physical facility controls), those items are marked N/A with supporting rationale.

Key findings:

• 28 of 34 assessed controls are Implemented — fully addressed by AegisGate’s architecture, features, or operational model.
• 0 controls are Not Implemented — no gaps exist in applicable requirements.
• 6 controls are N/A — not applicable to a self-hosted software product deployed on customer infrastructure.
• AegisGate’s automated compliance engine enforces 15 HIPAA-specific controls (HIPAA-AS-001 through HIPAA-TS-006, HIPAA-AI-001, HIPAA-AI-002) via 857+ CheckFuncs across 27 frameworks.

Scope and Methodology

Scope

This assessment covers the AegisGate Security Platform in its production deployment configuration:

• Product: AegisGate — self-hosted security gateway for AI infrastructure
• Deployment Model: Docker container on customer-managed infrastructure
• Data Flow: All ePHI remains within customer-controlled environments; AegisGate never transmits, stores, or processes ePHI outside the customer’s network perimeter
• Assessment Boundaries: Administrative, physical, and technical safeguards as defined in 45 C.F.R. §§ 164.308–164.312; organizational requirements per § 164.314; policies and procedures per § 164.316

Methodology

1. Control mapping: Each HIPAA Security Rule requirement was mapped to AegisGate’s architecture, features, and operational capabilities.
2. Implementation verification: Functional claims were validated against product documentation, source code, and deployment specifications.
3. Automated assessment: AegisGate’s built-in compliance engine (27 frameworks, 857+ CheckFuncs) was used to verify HIPAA-specific control implementations.
4. Gap analysis: Any requirement not fully addressed was documented with remediation guidance. No open gaps were identified in this assessment cycle.

Applicability Notes

AegisGate is a software product, not a covered entity or business associate in the regulatory sense. This assessment is provided to assist covered entities and business associates who deploy AegisGate in demonstrating their own HIPAA compliance. Physical safeguard requirements (§ 164.310) that pertain to facility management are the customer’s responsibility and are marked N/A.

Assessment Results

Administrative Safeguards (45 C.F.R. § 164.308)

Administrative safeguards constitute the foundation of HIPAA compliance. AegisGate supports these requirements through role-based access, automated compliance enforcement, and audit capabilities that enable covered entities to implement and demonstrate administrative controls.

Physical Safeguards (45 C.F.R. § 164.310)

Physical safeguard requirements address facility security, workstation protection, and device/media controls. As a self-hosted software product deployed on customer-controlled infrastructure, AegisGate does not control physical facilities. Physical safeguard compliance is the customer’s responsibility. AegisGate provides software-level controls that support the customer’s physical safeguard program.

Technical Safeguards (45 C.F.R. § 164.312)

Technical safeguards are the core domain where AegisGate provides the strongest compliance coverage. Every technical safeguard requirement is addressed through AegisGate’s architecture and feature set.

Organizational Requirements (45 C.F.R. § 164.314)

Organizational requirements address the contractual and assurance obligations between covered entities and their business associates. AegisGate’s self-hosted deployment model simplifies these requirements by ensuring that ePHI never leaves the customer’s direct control.

Policies and Procedures (45 C.F.R. § 164.316)

Policies and procedures requirements govern the documentation, retention, and availability of compliance records. AegisGate provides the technical infrastructure to support these requirements while documentation governance remains a shared responsibility.

HIPAA Automated Control Mapping

The following table maps AegisGate’s built-in HIPAA compliance checks to the Security Rule requirements they enforce. These controls are continuously evaluated by the compliance engine as part of the 857+ CheckFunc library.

Risk Assessment Summary

Inherent Risk Analysis

AegisGate’s self-hosted architecture fundamentally reduces several categories of risk that are inherent in cloud-hosted or SaaS security solutions:

Residual Risk Assessment

Items marked Partial in the assessment tables represent shared responsibilities where AegisGate provides technical controls and the customer implements organizational controls:

1. Security awareness training (§ 164.308(a)(5)(ii)(A)): AegisGate provides security alerts and compliance visibility; customers must implement periodic training programs.
2. Contingency planning (§ 164.308(a)(7)): AegisGate provides data export, configuration versioning, and rapid container recovery; customers must implement comprehensive BCDR plans for their infrastructure.
3. Documentation retention (§ 164.316(b)(1)): AegisGate provides configurable log retention exceeding 6 years; customers must retain organizational policy documents independently.
4. Workstation security (§ 164.310(c)): AegisGate provides encryption and access controls at the application layer; physical workstation security is the customer’s responsibility.

All residual risks are within acceptable levels for covered entities and business associates who implement the recommended customer-side controls.

Risk Acceptance Statement

No unacceptable risks were identified. All applicable HIPAA Security Rule requirements are addressed through AegisGate’s architectural controls, automated compliance enforcement, or documented shared responsibility with the customer.

Attestation

This self-assessment has been prepared in accordance with the HIPAA Security Rule (45 C.F.R. §§ 164.302–318) and represents an accurate evaluation of AegisGate’s compliance posture as of the effective date stated herein.

This document does not constitute a HIPAA certification — no such certification exists. Compliance with the HIPAA Security Rule is demonstrated through documented assessments, implemented safeguards, and ongoing risk management. This self-assessment is provided to support covered entities and business associates in their own compliance documentation.

Compliance & Security Engineering

AegisGate Security Platform

This assessment is subject to annual review and update. Changes to AegisGate’s architecture, deployment model, or applicable regulations may necessitate interim reviews. Contact compliance@aegisgate.io for questions or to request additional documentation.