Healthcare tech exec here and former HITRUST auditor. I appreciate the direction this is going, but I'm not sure about its general utility. As an example, aud

Healthcare tech exec here and former HITRUST auditor. I appreciate the direction this is going, but I'm not sure about its general utility. As an example, audits are commonly performed in middeware in the app stack. Same with permissions. Querying information_schema for sensitive column names isn't particularly useful as a PHI check. Overall, I'm concerned that using this may give application authors a false sense of security, or raise a bunch of false flags. There are many effective paths to compliance, which is why HIPAA is non-prescriptive. After a brief review of the source code, my recommendation would be to migrate this to more of an open source compliance checklist type app, rather than attempting a db level audit. I don't think it's practical to implement something that would be actually effective in the way you're approaching it.