npm package: @hipaaagent/network-scanner
Description: HIPAA Agent Network Scanner — Local agent for internal network security assessment. 14-phase scan covering encryption, MFA, segmentation, asset inventory, medical devices, and more.
Author: Sentinel Health Compliance
Latest version: 2.0.0

# HIPAA Agent — Network Scanner v2.0

Local network security assessment agent for HIPAA compliance. Updated for May 2026 HIPAA Security Rule requirements.

## Quick Start

```bash
npm install -g @hipaaagent/network-scanner
hipaa-scan register --api-key YOUR_KEY
hipaa-scan scan
```

## 12-Phase Scan

| Phase | Name | Description |
|-------|------|-------------|
| 1 | Network Discovery | Detects local IPs and target subnets |
| 2 | Host Discovery | Multi-port TCP (80, 443, 22, 445, 3389) + ARP fallback |
| 3 | Port Scanning | 30 HIPAA-critical ports scanned per host |
| 4 | SSL Certificate Audit | Expiry, self-signed, chain validation |
| 5 | Medical Device Detection | DICOM (4104) and HL7 (2575) protocol identification |
| 6 | Encryption at Rest | BitLocker, FileVault, LUKS verification |
| 7 | MFA Detection | SSH key auth, RDP NLA, web-based 2FA keywords |
| 8 | Asset Inventory | Device classification by port fingerprint + OS detection |
| 9 | Network Segmentation | Subnet analysis, medical device isolation check |
| 10 | Patch & EOL Detection | Version banner matching against EOL database |
| 11 | Backup Detection | rsync, iSCSI, Synology, Veeam, Acronis, Webmin |
| 12 | ePHI Flow Mapping | Data flow analysis: medical → database → web → remote |

Phases 4–12 are skipped when using `--quick`.

## Requirements

- Node.js 18+
- Network access to target subnet
- API key from your HIPAA Agent portal

## Commands

```bash
# Register agent with your account
hipaa-scan register --api-key YOUR_KEY

# Run full 12-phase scan
hipaa-scan scan

# Scan specific subnet
hipaa-scan scan --target 192.168.1.0/24

# Quick port scan only (phases 1-3)
hipaa-scan scan --quick

# Check registration status
hipaa-scan status

# Show help
hipaa-scan help
```

## Results

Scan results automatically upload to your HIPAA Agent account and are delivered to your inbox. If offline, results save to `~/.hipaa-agent/scans/` and upload on next connection.

## HIPAA-Critical Ports (30)

| Port | Service | Risk Level |
|------|---------|------------|
| 23 | Telnet | CRITICAL — Unencrypted remote access |
| 4104 | DICOM | CRITICAL — Medical imaging, PHI exposure |
| 2575 | HL7 | CRITICAL — Health messaging, PHI |
| 5900 | VNC | CRITICAL — Often unencrypted |
| 6667 | IRC | CRITICAL — Should not exist on healthcare network |
| 3389 | RDP | HIGH — Brute-force target |
| 445 | SMB | HIGH — File sharing, ransomware vector |
| 161 | SNMP | HIGH — Community string exposure |
| 27017 | MongoDB | HIGH — Often misconfigured auth |
| 3306 | MySQL | HIGH — Database access |
| 1433 | MSSQL | HIGH — Database access |
| 1521 | Oracle | HIGH — Database access |
| 5432 | PostgreSQL | HIGH — Database access |
| 80 | HTTP | MEDIUM — Unencrypted web |
| 8080 | HTTP Alt | MEDIUM — May be admin panel |
| 5000 | Synology HTTP | MEDIUM — NAS management |
| 10000 | Webmin | MEDIUM — Admin panel |
| 22 | SSH | INFO — Remote access |
| 25 | SMTP | INFO — Email server |
| 443 | HTTPS | INFO — Web server |
| 8443 | HTTPS Alt | INFO — Web application |
| 515 | LPD | INFO — Printer |
| 873 | rsync | INFO — Backup service |
| 3260 | iSCSI | INFO — Storage/backup |
| 5001 | Synology HTTPS | INFO — NAS management |
| 9100 | RAW Print | INFO — Printer |
| 9392 | Veeam | INFO — Backup console |
| 9393 | Veeam HTTPS | INFO — Backup console |
| 9876 | Acronis | INFO — Backup |
| 9877 | Acronis HTTPS | INFO — Backup |

## May 2026 HIPAA Security Rule Coverage

The scanner verifies 7 of 13 May 2026 requirements directly:

1. **Encryption at rest** — §164.312(a)(2)(iv)
2. **Multi-factor authentication** — §164.312(d)
3. **Asset inventory & classification** — §164.310(d)(1)
4. **Network segmentation** — §164.312(a)(1)
5. **Patch management & EOL** — §164.308(a)(5)(ii)(B)
6. **Backup & 72-hour restore** — §164.308(a)(7)(ii)(A)
7. **ePHI data flow mapping** — §164.312(e)(1)

Remaining 6 requirements are verified through external scan, SRA, policies, training, and BAA management.

## Privacy

- All scans are performed locally on YOUR network
- Only scan results are uploaded (no raw network traffic)
- Data encrypted in transit via HTTPS
- You control what networks are scanned

## Support

- Portal: https://hipaaagent.ai/portal/network-agent
- Documentation: https://hipaaagent.ai/docs/network-scanner
- Email: compliance@hipaaagent.ai