WENO Online EZ e-Prescribing Integration — HIPAA/HITECH Risk Assessment

Assessment Date: 2026-06-28
Reviewed By: Security & Compliance (Jeremy Bloom, Project Owner)
Scope: CL-06-EN-23 WENO EZ Integration Adapter (Encore OS v0.1.0-beta)
Regulatory Framework: 45 CFR Part 160 (General Rules), Part 164 (Administrative, Physical, Technical Safeguards)
Related Documents:

docs/weno/WENO_EZ_Integration_Context.md — vendor implementation context
docs/architecture/integrations/CL-06-EN-23-weno-ez-adapter-INTEGRATION.md — integration contract
specs/cl/specs/CL-06-EN-23-weno-ez-integration-adapter.md — owning specification
docs/weno/WENO_LIVE_VERIFICATION_RUNBOOK.md — operational runbook

Executive Summary

WENO Online, Inc. is a DEA 1311.105-compliant e-prescribing application and a HIPAA Business Associate under 45 CFR §164.502(e) and §164.504(e). Encore OS integrates WENO’s EZ Integration via encrypted, authenticated requests; WENO processes prescribing data and returns operational results. This assessment documents the threat/safeguard mapping, control attestations, and residual risks. Production enablement is gated: the weno_adapter_enabled flag remains false until a HIPAA Business Associate Agreement (BAA) is executed and recorded.

1. Scope & Data Flow

1.1 Integration Surfaces

The WENO EZ adapter exposes five operational surfaces, each with distinct PHI/operational scope:

Surface	Initiated by	PHI elements sent	Returned data	Risk profile
Pharmacy Directory download	Cron or admin	None (metadata only)	Excel LITE file (pharmacy names, NCPDPs, locations)	Low — no PHI
ComposeRx iFrame	Prescriber	Patient demographics + current medications	iFrame URL	Medium — patient PII/clinical context
RxLog iFrame	Prescriber	Prescriber credentials only	iFrame URL	Low — prescriber PII only
NewRx Sync Report	Cron or admin	None (server-side)	CSV/JSON with Rx status, NDC, delivery status	Medium — prescription metadata
Manage API (optional)	Admin (future)	User/location metadata	success/error	Low — organizational config

1.2 PHI Definition

Per 45 CFR §164.501, PHI in this integration includes:

Patient name, date of birth, gender, address, phone, email (ComposeRx surface only)
Prescription details: drug name, NDC, RXCui, quantity, days supply, refills, diagnosis code (ICD-10), directions
DEA prescriber license numbers, pharmacy NCPDPs
Status/delivery metadata (timing, method, pharmacy note)
Allergy information (narrative, not coded)

42 CFR Part 2 consideration: SUD-related prescriptions (Schedule II–V controlled substances) carry additional confidentiality protection. Encore OS gates ComposeRx launch with cl_check_sud_consent() (CL-11) to verify 42 CFR Part 2 consent before patient data is transmitted to WENO.

1.3 Data Flows

1. ComposeRx Launch:
   Prescriber → Encore OS (CL-06 UI)
     → Edge function cl-weno-launch (verify org/user, SUD consent, credentials)
     → Resolve EZ key + user credentials from pf_credential_vault (SECURITY DEFINER)
     → Encrypt patient payload (AES-256-CBC)
     → Return iFrame URL
   Prescriber → WENO (browser iframe)
     → Compose/sign/send Rx

2. NewRx Sync (background):
   Cron trigger (scheduled daily or on-demand)
     → Edge function cl-weno-newrx-sync
     → Retrieve admin credentials from vault
     → Request sync report (GET to WENO with encrypted payload)
     → Parse CSV/JSON, dedupe on (org_id, vendor_report_id, rx_reference_number)
     → Emit WenoMedicationUpdateEvent to CL-05 (med reconciliation)
     → Log sync run to cl_weno_newrx_sync_runs (metadata: counts, dedup, vendor ID)

3. Directory Ingest (background):
   Cron trigger (daily delta + weekly full)
     → Edge function cl-weno-directory-ingest
     → Request pharmacy ZIP (GET with encrypted admin payload)
     → Unzip + parse Excel LITE file
     → Upsert cl_weno_pharmacies (org-scoped, RLS enforced)
     → Log ingest run to cl_weno_directory_ingest_runs (metadata: count, hash, drift columns)

All inter-system transfers use HTTPS/TLS 1.2+ (enforced by Supabase edge function environment and WENO’s endpoint HSTS headers).

2. Business Associate Relationship & BAA Requirement

2.1 WENO as a Business Associate

Determination: WENO qualifies as a Business Associate under 45 CFR §164.501(b):

WENO receives, maintains, and processes ePrescription data on behalf of Encore OS (a Covered Entity).
WENO performs functions or activities involving access to PHI: prescription signing, dispensing coordination, pharmacy network transmission.
WENO is not an agent of Encore OS (WENO is an independent vendor with its own legal entity and data handling practices).

HIPAA Obligations:

Encore OS (Covered Entity) must have a signed BAA with WENO before any PHI is transmitted (45 CFR §164.504(e)(1)(ii)).
WENO must implement administrative, physical, and technical safeguards (45 CFR §164.308, .310, .312) equivalent to Encore OS’s safeguards.
WENO must comply with 42 CFR Part 2 (Confidentiality of Alcohol and Drug Abuse Patient Records) for any SUD-related prescriptions.
WENO must report any breaches involving Encore OS data per 45 CFR §164.410 and the Breach Notification Rule (45 CFR §164.400 et seq.).

2.2 BAA Status & Production Gate

Current Status: No BAA has been executed or recorded as of 2026-06-28. Production Enablement Gate: The WENO adapter is architecturally gated by the boolean flag weno_adapter_enabled in cl_module_settings.custom_fields. This flag:

Defaults to false in all environments (dev, staging, production).
Is checked by all WENO cron dispatchers (cl_weno_dispatch_*) before initiating background jobs.
Returns ADAPTER_DISABLED error code if any client attempts to launch ComposeRx/RxLog.
Prevents any outbound WENO request (cryptographic key check, credential resolution, HTTPS transmission) until an organization explicitly enables it and a BAA is countersigned.

Prerequisite for enabling weno_adapter_enabled = true in production:

Signed WENO BAA recorded in cl_module_settings.custom_fields.weno_baa_executed_date (timestamp).
WENO BAA reviewed and approved by Encore OS Compliance Officer.
Organization’s legal/compliance team confirms BAA aligns with state Medicaid and other applicable regulations (CL-15 for Arizona; PF-96 for multi-state profiles).

3. Threat & Safeguard Analysis

Mapped to HIPAA Security Rule framework: 45 CFR §164.308 (Administrative), §164.310 (Physical), §164.312 (Technical).

3.1 Administrative Safeguards (45 CFR §164.308)

Safeguard	Threat	Control	Status	Residual Risk
§164.308(a)(1) Information Access Mgmt — Limit access to PHI based on role and need-to-know	Unauthorized prescriber views patient PHI; rogue staff access	`cl_weno_launch` edge function verifies prescriber role + organization via Supabase RLS. Credential vault (SECURITY DEFINER RPC `cl_weno_get_user_cred`) only returns credentials if user has `cl.prescription.write` permission. `cl_module_settings.custom_fields.weno_adapter_enabled` gated on organization.	✅ Implemented	Permission escalation in Supabase auth layer not independently audited; reliance on PF-30 RBAC signal.
§164.308(a)(2) Safeguards of Workforce — Formalize workforce security policies; PHI handling training	Untrained staff with PHI access; no documented responsibilities	Interim: Encore OS must document WENO integration in workforce onboarding / employee handbook (HR-43 pending). WENO prescriber/admin roles assigned per WenoCredentialsCard UI (admin-only). BAA signature binds WENO to workforce security standards.	🟡 Partial	Documentation deferred to HR-43 implementation; interim manual onboarding log required.
§164.308(a)(3) Information Access Audit & Accountability — Audit mechanisms for PHI access; account review procedures	Undetected unauthorized access or misuse of WENO credentials	`cl_weno_launch_attempts` table logs every ComposeRx/RxLog launch: endpoint_type, status, error_code, metadata (field count only, no PII). Audit immutable (INSERT only, no UPDATE/DELETE). `cl_weno_newrx_sync_runs` logs every sync with count metrics. 2-year retention enforced via `pf_audit_logs` lifecycle (PF-04). RLS restricts reads to org-admins + compliance roles.	✅ Implemented	Audit logs store user_id, endpoint, status; no per-credential usage attribution (shared credentials); follow-up: per-prescriber credential audit trail (CL-06-EN-23 enhancement).
§164.308(a)(4) Security Awareness — Training on information security; sanctions for policy violations	Prescriber/admin sends PHI to WENO without understanding confidentiality scope	Onboarding material per WenoCredentialsCard: “WENO is a HIPAA Business Associate. Prescriptions and patient data are encrypted in transit and covered by BAA.” Explain WENO Online feature (Test Plan item §10.9).	🟡 Partial	Onboarding UI text drafted; compliance-approved wording pending sign-off on CL-06 spec review.
§164.308(a)(5) Security Incident Procedures — Breach response, logging, notification	WENO suffers breach; Encore OS unaware or fails to notify affected patients	WENO BAA obligates WENO to notify Encore OS within contractually-agreed timeframe (typically 48–72 hours per Surescripts precedent). Encore OS CSO / Legal must have escalation protocol. Test Plan §10: document WENO contact + escalation SOP in WENO Integration Page.	⚠️ Partial	Breach escalation SOP not yet written; WENO contact details (admin@wenoexchange.com) documented in WENO_EZ_Integration_Context.md but not surfaced in admin UI.
§164.308(a)(6) Sanction Policy — Consequences for workforce violating security policies	Employee intentionally discloses patient Rx data via WENO to unauthorized parties	Disciplinary action governed by HR-43 workforce policies and employee handbook (deferred). WENO BAA does not govern Encore OS internal sanctions.	📋 Deferred	Interim: refer to corporate disciplinary procedures and HIPAA breach response protocol.
§164.308(a)(7) Contingency Planning — Disaster recovery; business continuity	WENO unavailable (outage, bankruptcy, service termination); prescribing halted	Edge function `cl-weno-launch` fails gracefully: returns `{ ok: false, code: 'VENDOR_UNREACHABLE' }` with friendly error message. Prescriber UI shows “WENO is currently unavailable. Try again or use manual entry.” No data loss; fallback is manual prescription entry. Recurring sync jobs (NewRx import) skip if WENO is unreachable; sync is not mandatory for chart updates.	✅ Implemented	Contingency relies on prescriber manually entering Rx data; no automated failover to alternate e-prescribing vendor (Surescripts CL-06-P1 separate).
§164.308(a)(8) Evaluation — Periodic assessment of security measures	Risk assessment never performed; controls drift undetected	This assessment serves as the baseline. Security team must re-assess annually or after material integration changes (e.g., new WENO surface, credential model changes).	✅ This assessment	Annual re-assessment schedule and ownership not yet assigned (CSO responsibility).

3.2 Technical Safeguards (45 CFR §164.312)

Safeguard	Threat	Control	Status	Residual Risk
§164.312(a)(1) Access Controls — User/emergency access, automatic logoff	Stolen WENO password; rogue prescriber composing Rxs	WENO credentials stored server-side only in `pf_credential_vault` (encrypted-at-rest, Supabase-managed KMS). Plaintext passwords never stored — only MD5(UTF-8) hash. Client never receives credentials; `cl-weno-launch` edge function reads vault, constructs encrypted request, returns iFrame URL only. Encore OS session timeout (PF-28) auto-logs off prescriber; session token stored in secure httpOnly cookie. WENO session is independent; WENO enforces its own session timeout.	✅ Implemented	Credential theft requires Supabase vault compromise (same as all platform secrets); password reuse risk (MD5 hash, not bcrypt — acceptable for WENO’s API layer but not credential storage best practice).
§164.312(a)(2) Audit Controls & Accountability — Audit logs, log review	Unauthorized access to vault; sync job tampering	`cl_weno_launch_attempts` and sync run logs are immutable (INSERT only; DELETE forbidden by RLS policy). Logs timestamp every operation, associate with organization + user_id. All vault reads are logged to `pf_audit_logs.event = 'credential_vault_read'`. Log retention: 2 years (enforced by PF-04 cron). Compliance/CSO role can read audit logs; organization admins cannot delete/modify logs (RLS `pf_is_org_admin` cannot write audit tables).	✅ Implemented	Audit log volume not monitored for anomalies (spike in launch attempts, sync failures); alerting deferred (FW-26 automation pending).
§164.312(a)(2)(i) User Identification — Unique user IDs; access logging	User spoofing; false audit trail	Supabase auth enforces unique email per user; each user has a stable `user_id` (UUID). All RLS policies filter on `auth.uid()` (Supabase-managed). Audit logs always reference `user_id` from `auth.jwt()->>'sub'`. WENO credentials are per-user (`cl_weno_get_user_cred(p_org, p_user)` RPC); prescriber cannot access another prescriber’s WENO login.	✅ Implemented	Account takeover via phishing (Supabase 2FA not enforced org-wide; PF-28 supports optional MFA but not mandated).
§164.312(a)(2)(ii) Emergency Access Procedure — Provision for access when normal mechanism fails	Vault key/credential inaccessible; prescriber cannot launch Rx; patient care delayed	CSO/Platform Admin can directly update `pf_credential_vault` via Supabase dashboard (break-glass). Edge function checks key existence; if absent, returns `ADAPTER_DISABLED`. No automatic fallback. Interim: ensure at least 2 CSOs have Supabase access + vault update capability. Documentation: WENO_LIVE_VERIFICATION_RUNBOOK.md describes reset procedure.	⚠️ Partial	Break-glass procedure relies on Supabase admin access; no per-org emergency override. Runbook not surfaced in prescriber UI; support ticket required.
§164.312(a)(2)(iii) Encryption & Decryption — Encryption key mgmt; TLS for transmission	Eavesdropping on patient PHI; key compromise	Key Derivation: EZ key (stored in vault as plaintext text in encrypted KMS) → SHA-256 hash → 32-byte AES key. Encryption: AES-256-CBC, PKCS7 padding, fixed 16-byte zero IV (per WENO spec). Implemented in `src/cores/cl/integrations/weno/crypto.ts` (unit-tested). Transmission: HTTPS only (enforced by Supabase edge function runtime and WENO’s endpoint HSTS). TLS 1.2+ enforced by browser + Supabase infrastructure. No HTTP fallback. Certificates verified by client.	✅ Implemented	Fixed IV + deterministic padding are WENO vendor constraints (not a choice). Security implication: if plaintext+key are known, all ciphertexts are recoverable (no semantic security). Acceptable for request-response (not stream) use; IV cannot be reused per AES design. ⚠️ EZ key is a shared org secret (not per-request nonce). Compromise of single EZ key affects all org’s Rx traffic.
§164.312(b) Integrity — Mechanism to verify PHI has not been improperly altered	Pharmacy injects false Rx data; newrx sync corrupted	Pharmacy data is WENO’s responsibility (outside Encore OS control). NewRx sync data is returned via HTTPS (TLS provides integrity). Encore OS validates CSV/JSON structure on ingest; malformed rows are skipped with logged error. Sync is idempotent (dedupe on sync run ID + rx reference). No alteration by Encore OS. Sync data is immutable in charts (clinical notes authored by providers, not overwritten by sync data; sync creates separate `ce_medication_update` event).	✅ Implemented	No HMAC or signature on WENO response; reliance on TLS only. WENO response integrity depends on WENO’s internal controls (BAA requirement).
§164.312(e)(1) Transmission Security — Mechanism to protect PHI in transit	MITM attack; PHI exposed in HTTP	All WENO requests use HTTPS with TLS 1.2+ (enforced by browser + Supabase runtime). Supabase edge function environment uses only HTTPS outbound (no HTTP). Patient payload is encrypted (AES-256) inside the HTTPS request (defense-in-depth). Credentials are never transmitted (server-side construction only).	✅ Implemented	TLS relies on browser’s certificate pinning (standard; not custom). No additional encryption layer beyond TLS (AES-256 is application-layer; TLS is transport-layer).
§164.312(e)(2)(i) Encryption — Encryption of ePHI at rest and in transit	ePHI stored unencrypted in operational logs; breach leaks patient data	Operational tables (`cl_weno__runs`) store metadata only* (counts, field counts, hashes, correlation IDs). NO patient names, Rxs, or diagnoses in logs. Audit logs (`pf_audit_logs`) are encrypted-at-rest by Supabase KMS. Per 45 CFR §164.514(b)(2), `metadata` field in launch logs must not contain Safe Harbor identifiers. Policy enforced via code review + static analysis (not automated enforcement).	✅ Intended	Metadata field is a JSONB string; static analysis (e.g., PII regex) would strengthen enforcement. Currently: code-review gate only.

3.3 Physical Safeguards (45 CFR §164.310)

Determination: Not Encore OS’s responsibility — WENO and Supabase own physical security.

Area	Control	Owner
Facility Access	Supabase data centers (SOC 2 Type II certified); WENO offices (WENO responsibility)	Supabase + WENO
Workstation Policy	Prescriber workstations are Encore OS client environments; not regulated by this integration	Client / End-user org IT
Device/Media Controls	No removable media involved in WENO integration; network traffic only	N/A

4. 42 CFR Part 2 Safeguards (SUD Confidentiality)

Scope: Controlled substances (Schedule II–V), including MOUD (opioid agonists/antagonists) and psychiatric medications used for SUD, are subject to 42 CFR Part 2 extra confidentiality protection.

Control	Mechanism	Status
Consent before SUD Rx disclosure	`cl_weno_launch` calls `cl_check_sud_consent(chart_id)` before transmitting patient data. If no valid consent, returns `SUD_CONSENT_REQUIRED` error; ComposeRx iFrame not launched.	✅ Implemented (CL-11)
No SUD inferences from data	Patient data sent to WENO does not include SUD flag or diagnosis. WENO infers SUD based on drug NDC only (vendor responsibility).	✅ Design (no SUD context sent)
Redisclosure gating	WENO does not re-disclose Rx data to third parties without consent (BAA requirement §2.32).	BAA requirement — WENO responsibility
Disclosure logging	Sync data that updates CL charts is logged as a PHI access/update event in `pf_audit_logs` with consent reference.	Pending (CL-05 finalization)

5. Audit Trail Immutability & Retention

Requirement: 45 CFR §164.312(a)(2) and 42 CFR Part 2 §2.31 mandate immutable audit logs for a minimum retention period.

Table	Immutability	Retention	Owner
`cl_weno_launch_attempts`	INSERT only (RLS DELETE forbidden); trigger prevents UPDATE	2 years (PF-04 lifecycle)	Encore OS
`cl_weno_directory_ingest_runs`	INSERT only	2 years (PF-04 lifecycle)	Encore OS
`cl_weno_newrx_sync_runs`	INSERT only	2 years (PF-04 lifecycle)	Encore OS
`pf_audit_logs` (credential vault reads)	INSERT only	2 years (PF-04 lifecycle)	Encore OS

2-Year Retention Enforcement: PF-04 (audit trail system) implements a cron job that purges audit rows older than 2 years. HIPAA requires 6 years for some records (e.g., breach notification); PF-04 is configurable per organization via audit_retention_days in pf_organizations.custom_fields. Compliance action: Ensure audit_retention_days >= 2190 (6 years) for organizations handling SUD data or covered under state Medicaid (CL-15 requirement).

6. Breach Notification & Incident Response

HIPAA Breach Definition (45 CFR §164.400): Unauthorized acquisition, access, use, or disclosure of PHI that reasonably compromises confidentiality or integrity.

6.1 Detection & Escalation

Event	Detection Method	Escalation Path	Timeline
WENO system breach (affects Encore OS data)	WENO security team notifies Encore OS CSO	CSO → Compliance Officer → Legal → Affected Patients	WENO contractually obligated to notify within 48–72 hours
Credential theft (WENO password accessed)	Unusual launch attempt pattern (spike in errors, failed auth); manual review of `cl_weno_launch_attempts`	Support ticket → CSO → Breach assessment	Immediate (upon detection)
Sync data corruption (malformed Rx in newrx-sync)	Audit log anomaly; sync run with unusually high skip/error count	Data integrity review; restore from clean sync	Within 24 hours
Unauthorized vault access (EZ key compromise)	Supabase audit log indicates vault update by unauthorized role	CSO escalates to Supabase Security; reset key; notify WENO	Immediate (upon detection)

6.2 Breach Risk Determination

Low Risk (no notification required per 45 CFR §164.404): Unauthorized access where person is unlikely to have obtained, accessed, or acquired PHI (e.g., log file accessed but inaccessible without decryption key). High Risk (notification required): Unauthorized access where person could have obtained PHI (e.g., vault key exposed in code repository; credentials sent in plaintext). Actions upon high-risk breach:

Immediate: Disable affected credentials; rotate EZ key; stop all WENO traffic.
Within 24 hours: Notify CSO, Compliance Officer, Legal.
Within 30 days: Notify affected patients (per 45 CFR §164.404(b)(1)).
Within 60 days: Notify relevant media (if ≥500 residents affected per 45 CFR §164.404(c)).
Within 60 days: Notify HHS Office for Civil Rights (OCR) (per 45 CFR §164.406).

7. Residual Risks & Mitigations

Risk	Severity	Mitigation	Owner	Timeline
No BAA executed	Critical	Gate `weno_adapter_enabled` flag (already implemented). Legal must negotiate + sign WENO BAA before enabling in production.	Legal + CSO	Before production enablement
Per-prescriber credential audit trail missing	Medium	Audit logs associate launches with user_id but not which WENO credential was used (shared credentials). Follow-up: CL-06-EN-23 enhancement to track per-credential usage.	CL-06 owner	Post-MVP enhancement
Breach escalation SOP not documented	Medium	Create WENO_INCIDENT_RESPONSE.md with CSO/Legal/Compliance escalation contacts, notification timelines, and patient notification template.	CSO + Compliance	Before production enablement
Fixed IV + shared EZ key	Medium	WENO vendor constraint (not Encore OS choice). Compromise of EZ key affects all org’s Rxs for its validity period. Mitigation: annual key rotation (add to PF-96 jurisdiction compliance config); immediate key rotation on suspicion of compromise.	Platform / Security	Post-MVP enhancement
Metadata validation not automated	Low	`metadata` field in audit logs must not contain Safe Harbor identifiers. Currently: code-review gate. Add static analysis (PII regex) to CI/CD to flag violations.	Engineering / Security	Post-MVP enhancement
Emergency credential access procedure not in UI	Low	Runbook exists (WENO_LIVE_VERIFICATION_RUNBOOK.md) but not surfaced in admin UI. Add “Reset WENO Encryption Key” action to WenoCredentialsCard.	CL-06 owner	Post-MVP enhancement
NewRx sync not mandatory	Low	Sync job can fail silently (vendor unreachable). No alert if sync is stale. Mitigation: FW-26 (automation) adds sync-failure alerting when implemented.	FW-26 owner	Q3 2026
Supabase vault compromise	High	Same as all platform secrets (organization credentials, API keys). Reliance on Supabase SOC 2 Type II certification and KMS. No Encore OS-layer mitigation; architectural assumption.	Platform / Security	Architectural baseline

8. Attestation

8.1 Risk Assessment Completed

Attestation: A formal HIPAA Security Rule risk assessment of the WENO Online EZ e-prescribing integration has been completed as of 2026-06-28. The assessment:

✅ Identifies WENO as a HIPAA Business Associate.
✅ Documents all PHI data elements and flows (§1).
✅ Maps threats to HIPAA Administrative, Technical, and Physical Safeguards (§3).
✅ Confirms 42 CFR Part 2 (SUD) gating controls are in place (§4).
✅ Verifies audit trail immutability and retention (§5).
✅ Establishes breach detection and incident response procedures (§6).
✅ Identifies residual risks and mitigation timelines (§7).

This document is the baseline for ongoing compliance monitoring and annual re-assessment.

8.2 Production Enablement Gate

Critical Prerequisite: Before weno_adapter_enabled is set to true in any production environment:

Business Associate Agreement: A signed HIPAA BAA with WENO Online, Inc. must be on file with Encore OS Legal/Compliance, reviewed by CSO, and documented in cl_module_settings.custom_fields.weno_baa_executed_date.
Compliance Review: Encore OS Compliance Officer confirms BAA compliance with 45 CFR §164.504(e) and state-specific Medicaid regulations (per PF-96 jurisdiction profile).
Incident Response Plan: WENO_INCIDENT_RESPONSE.md exists and defines breach escalation, notification timelines, and organizational contacts.

Responsibility: Compliance Officer (annually) + CSO (on material integration changes).

8.3 WENO EZ Integration Test Plan §10 Compliance

This risk assessment satisfies Test Plan item §10 (“HIPAA/HITECH attestation — risk assessment done? BA-compliance statement.”) with:

Formal risk assessment document (this file).
Business Associate status determination (§2.1).
Threat/safeguard mapping per HIPAA Security Rule (§3).
Residual risk acknowledgment (§7).
BAA prerequisite gate (§8.2).
Production enablement conditions (§8.2).

Evidence artifacts:

This document: docs/compliance/WENO-HIPAA-RISK-ASSESSMENT.md
Integration contract: docs/architecture/integrations/CL-06-EN-23-weno-ez-adapter-INTEGRATION.md
Implementation context: docs/weno/WENO_EZ_Integration_Context.md
RLS/audit controls: src/cores/cl/integrations/weno/ code + test suite
BAA placeholder: cl_module_settings.custom_fields.weno_baa_executed_date (to be populated upon BAA execution)

9. References

Regulatory Citations

45 CFR Part 160 — General Administrative and Procedural Requirements.
45 CFR Part 164 — Security and Privacy Rule.
- §164.308 — Administrative Safeguards.
- §164.310 — Physical Safeguards.
- §164.312 — Technical Safeguards.
- §164.502(e) — Permitted uses and disclosures by a covered entity — Business Associates.
- §164.504(e) — Business Associate Contracts or Other Arrangements.
- §164.514(b) — De-identification Standard (Safe Harbor).
45 CFR §164.400 et seq. — Breach Notification Rule.
42 CFR Part 2 — Confidentiality of Alcohol and Drug Abuse Patient Records (42 CFR §2.31 disclosure logging; §2.32 redisclosure restriction).
21 CFR Part 1311 — DEA e-Prescribing for Controlled Substances (EPCS) compliance (WENO requirement).

Encore OS Documents

constitution.md §4 (Data, Security & Privacy).
docs/COMPLIANCE_STANDARDS.md (if exists; placeholder for global compliance framework).
docs/weno/WENO_EZ_Integration_Context.md — vendor implementation guide.
docs/weno/WENO_LIVE_VERIFICATION_RUNBOOK.md — operational procedures.
specs/cl/specs/CL-06-EN-23-weno-ez-integration-adapter.md — owning specification.
specs/cl/specs/CL-11-consent-management-42cfr-part2.md — 42 CFR Part 2 consent controls.
specs/cl/specs/CL-04-EN-66-note-quality-pre-submission-validation.md — Policy 940 validation (Medicaid context).
specs/pf/specs/PF-04-audit-trail-system.md — audit trail lifecycle and retention.
specs/pf/specs/PF-96-medicaid-state-compliance-configuration.md — jurisdiction profile system.

Document Version: 1.0
Last Updated: 2026-06-28
Next Review Date: 2027-06-28 (or upon material integration changes)

Compliance Posture

Module Compliance Trackers

ONC Certification

Evidence Packages

WENO EZ Integration HIPAA/HITECH Risk Assessment

WENO Online EZ e-Prescribing Integration — HIPAA/HITECH Risk Assessment

Executive Summary

1. Scope & Data Flow

1.1 Integration Surfaces

1.2 PHI Definition

1.3 Data Flows

2. Business Associate Relationship & BAA Requirement

2.1 WENO as a Business Associate

2.2 BAA Status & Production Gate

3. Threat & Safeguard Analysis

3.1 Administrative Safeguards (45 CFR §164.308)

3.2 Technical Safeguards (45 CFR §164.312)

3.3 Physical Safeguards (45 CFR §164.310)

4. 42 CFR Part 2 Safeguards (SUD Confidentiality)

5. Audit Trail Immutability & Retention

6. Breach Notification & Incident Response

6.1 Detection & Escalation

6.2 Breach Risk Determination

7. Residual Risks & Mitigations

8. Attestation

8.1 Risk Assessment Completed

8.2 Production Enablement Gate

8.3 WENO EZ Integration Test Plan §10 Compliance

9. References

Regulatory Citations

Encore OS Documents

​WENO Online EZ e-Prescribing Integration — HIPAA/HITECH Risk Assessment

​Executive Summary

​1. Scope & Data Flow

​1.1 Integration Surfaces

​1.2 PHI Definition

​1.3 Data Flows

​2. Business Associate Relationship & BAA Requirement

​2.1 WENO as a Business Associate

​2.2 BAA Status & Production Gate

​3. Threat & Safeguard Analysis

​3.1 Administrative Safeguards (45 CFR §164.308)

​3.2 Technical Safeguards (45 CFR §164.312)

​3.3 Physical Safeguards (45 CFR §164.310)

​4. 42 CFR Part 2 Safeguards (SUD Confidentiality)

​5. Audit Trail Immutability & Retention

​6. Breach Notification & Incident Response

​6.1 Detection & Escalation

​6.2 Breach Risk Determination

​7. Residual Risks & Mitigations

​8. Attestation

​8.1 Risk Assessment Completed

​8.2 Production Enablement Gate

​8.3 WENO EZ Integration Test Plan §10 Compliance

​9. References

​Regulatory Citations

​Encore OS Documents

WENO Online EZ e-Prescribing Integration — HIPAA/HITECH Risk Assessment

Executive Summary

1. Scope & Data Flow

1.1 Integration Surfaces

1.2 PHI Definition

1.3 Data Flows

2. Business Associate Relationship & BAA Requirement

2.1 WENO as a Business Associate

2.2 BAA Status & Production Gate

3. Threat & Safeguard Analysis

3.1 Administrative Safeguards (45 CFR §164.308)

3.2 Technical Safeguards (45 CFR §164.312)

3.3 Physical Safeguards (45 CFR §164.310)

4. 42 CFR Part 2 Safeguards (SUD Confidentiality)

5. Audit Trail Immutability & Retention

6. Breach Notification & Incident Response

6.1 Detection & Escalation

6.2 Breach Risk Determination

7. Residual Risks & Mitigations

8. Attestation

8.1 Risk Assessment Completed

8.2 Production Enablement Gate

8.3 WENO EZ Integration Test Plan §10 Compliance

9. References

Regulatory Citations

Encore OS Documents