SOC 2 and HIPAA Compliance Pack

CaseSolo exposes the compliance pack through /api/compliance/soc2, /api/compliance/hipaa, /api/admin/data-retention, and the audit-log export routes. These endpoints are admin-only and rely on proxy-authenticated x-user-id, x-firm-id, and x-user-role headers.

HIPAA Pack

GET /api/compliance/hipaa returns:

• config: firm-level HIPAA controls from Firm.settings.hipaa.
• compliance: computed readiness score and issues.
• retentionPolicies: firm policies or the default legal/medical policy set.
• recentLogs: PHI access logs from immutable Activity records.
• redactionWorkflow: pending/completed redaction queue built from case HIPAA tags.
• baaTemplate: current BAA template with rendered content plus structured sections.
• evidenceExport: the export endpoint contract.

GET /api/compliance/hipaa?export=evidence returns a no-store JSON evidence packet with BAA template, readiness config, retention audit, PHI access logs, redaction workflow, and safeguards. The route writes hipaa.evidence_exported through auditLog.

POST /api/compliance/hipaa supported actions:

• update_config: merge HIPAA config and audit hipaa.config_updated.
• update_retention_policies: save retention policies and audit hipaa.retention_policies_updated.
• run_retention_audit: compute expired documents by retention policy.
• sign_baa: mark the BAA signed and audit hipaa.baa_signed.
• preview_redaction: detect/redact PHI and return spans without raw PHI match text.
• log_phi_access: append a PHI access entry using phi_access_<action>.
• export_evidence: POST equivalent of the evidence export.

SOC 2 Pack

GET /api/compliance/soc2 collects automatable evidence for access controls, MFA/config, change logs, backups, encryption, monitoring, and processing integrity.

POST /api/compliance/soc2 supports:

• collect_evidence with controlId.
• collect_all for all automatable controls.

Manual SOC 2 controls remain explicitly partial until a human uploads or verifies policy/training/vendor/incident evidence.

Retention Controls

/api/admin/data-retention manages broad firm retention settings:

• auditLogRetentionDays
• deletedRecordRetentionDays
• sessionRetentionDays

HIPAA document-retention policy details live in the HIPAA route as retentionPolicies, with audit-ready evidence export through export=evidence.

Security Notes

• Evidence exports are Cache-Control: no-store.
• Evidence exports and admin configuration changes create immutable audit records.
• Redaction previews intentionally omit raw matched PHI in matches; only spans, categories, and redacted text are returned.
• PHI access logs are firm-scoped and represented as Activity rows with metadata.phiAccess = true.
• This pack is not a legal opinion or certification. It provides product evidence and operational controls for firm administrators and auditors.