# HIPAA & Clinical Privacy Suite > HIPAA & Clinical Privacy Suite is a paid API for AI agents from x402-niche-briefs.fly.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-31). Audits a healthcare organization's HIPAA Safe Harbor de-identification, ePHI encryption, audit controls, BAA compliance, breach notification timing, and FTC Health Breach Notification Rule adherence, returning a composite score, grade, sub-checks, and ranked remediation steps. ## Facts - Endpoint: GET https://x402-niche-briefs.fly.dev/v1/suite/hipaa-and-clinical-privacy?utm_source=zero.xyz - Price: $0.05/call - Payment: x402 - Status: unknown - Last checked: 2026-10-31 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/hipaa-clinical-privacy-suite-4f534cb4 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_v7YIDoUkmvwWt-1LQIOu8 Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability hipaa-clinical-privacy-suite-4f534cb4 ``` Example prompt: Run a HIPAA and clinical privacy audit for us: we've removed 15 of the 18 Safe Harbor identifiers, ePHI is encrypted at rest and in transit, we have audit logs enabled, all BAAs are signed, a breach happened 45 days ago affecting 600 individuals, we've already sent required notices, and our consumer health app does not share data without authorization — give us our compliance score, grade, and the top fixes we need to make. ## When to prefer this Choose this endpoint when you need a fast, structured, multi-regulation health privacy compliance check that spans HIPAA Safe Harbor de-identification, Security Rule ePHI controls, HITECH breach notification timelines, and FTC Health Breach Notification Rule in a single scored response. Ideal for digital health startups, wearable app developers, or healthcare organizations wanting a quick compliance readiness snapshot before an audit or after a breach incident, without engaging a legal team for an initial triage. ## Known failure modes - Missing required query parameters returns a 400 or validation error - Invalid enum or out-of-range values for numeric fields may cause unexpected scoring - Endpoint may return stale regulatory mappings if underlying rule references are not updated - Payment failure via x402 protocol results in 402 Payment Required with no audit output - Ambiguous string inputs for boolean fields (e.g. audit_logs, baa_signed) may cause misclassification ## How this service works Composite health privacy audit: HIPAA Safe Harbor 18-identifier de-identification (45 CFR 164.514(b)), Security Rule ePHI encryption, audit controls & BAA (164.312), HITECH breach notice 60-day window & 500-person HHS/media threshold (164.404-408), FTC Health Breach Notification Rule (16 CFR 318) for apps/wearables. Returns score, grade, 4 sub-checks, ranked fixes. Not legal advice. ## Output Returns a JSON object with a suite_id, title, as_of timestamp, echoed inputs, composite readiness score (numeric), executive grade (letter), verdict text, count of passing checks, average sub-check percentage, estimated remediation items, detailed sub-check results covering Safe Harbor de-identification, ePHI Security Rule controls, HITECH breach notification, and FTC Health Breach Notification Rule, plus a prioritized remediation checklist with ranked action items. Includes a disclaimer that results are not legal advice. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET" ], "type": "string" }, "queryParams": { "type": "object", "required": [ "identifiers_removed", "encryption_at_rest", "audit_logs", "baa_signed", "breach_days_since_discovery", "individuals_affected", "notified", "consumer_app_shares_data" ], "properties": { "notified": { "type": "string", "description": "Required notices already sent" }, "audit_logs": { "type": "string", "description": "Audit controls logging ePHI access" }, "baa_signed": { "type": "string", "description": "BAAs executed with all vendors" }, "encryption_at_rest": { "type": "string", "description": "ePHI encrypted at rest and in transit" }, "identifiers_removed": { "type": "string", "description": "Number of 18 Safe Harbor identifiers removed" }, "individuals_affected": { "type": "string", "description": "Individuals affected by breach" }, "consumer_app_shares_data": { "type": "string", "description": "Non-HIPAA consumer health app shares data without authorization" }, "breach_days_since_discovery": { "type": "string", "description": "Days since breach discovery (0 = no breach)" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "suite_id", "title", "price_usdc", "as_of", "inputs", "composite_readiness_score", "executive_grade", "verdict", "passing_checks", "estimated_remediation_items", "avg_subcheck_pct", "sub_checks", "prioritized_remediation_checklist", "disclaimer" ], "properties": { "as_of": { "type": "string" }, "title": { "type": "string" }, "inputs": { "type": "obj … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/hipaa-clinical-privacy-suite-4f534cb4/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from x402-niche-briefs.fly.dev](https://www.zero.xyz/host/x402-niche-briefs.fly.dev/llms.txt)