SecureChart — Requirements

Goals

• Give a small healthcare practice a single, honest view of how ready it is for the proposed 2026 HIPAA Security Rule.
• Translate a dense regulatory proposal into a checklist a non-lawyer office manager can act on.
• Surface the highest-risk, highest-priority gaps first, with realistic cost and time estimates.
• Demonstrate enough value in a free scorecard to justify a paid tier for ongoing tracking and evidence collection.

Primary user

A practice manager or owner-practitioner at a solo or small healthcare practice (dental, therapy, chiropractic, small primary-care) with 1-15 staff and no dedicated compliance officer. They handle HIPAA compliance alongside scheduling, billing, and patient care, usually revisiting it only when renewing cyber-liability insurance or after a scare. Their job-to-be-done: know, in plain language, what's now legally required (not just recommended) and what it will cost to close the gap.

Functional requirements

• FR1: Display the current status of the proposed 2026 HIPAA Security Rule (NPRM stage, OMB target date, typical implementation window) in a persistent context banner.
• FR2: Load a practice profile (name, type, staff count) from sample data and display it in the header.
• FR3: Render a checklist of safeguards grouped by category (Technical, Administrative, Physical, Third-Party).
• FR4: For each safeguard, show the requirement, a plain-language description, its prior designation (addressable/unspecified), its new designation (required), a priority level, and a status.
• FR5: Allow the user to click a safeguard's status pill to cycle it through Not Started → In Progress → Done.
• FR6: Recalculate and re-render the readiness score, critical-item count, and remaining-cost estimate immediately after any status change.
• FR7: Provide category filter controls that narrow the checklist to one category or show all.
• FR8: Render a readiness score as a percentage and a visual gauge, color-coded by how close the practice is to done.
• FR9: Compute and display the count of open (not-Done) Critical-priority safeguards.
• FR10: Compute and display the total estimated remaining spend across all open safeguards, using each item's high-end cost estimate.
• FR11: Render a remediation roadmap listing only open safeguards, auto-sorted by priority (Critical → High → Medium → Low) then by estimated cost (ascending).
• FR12: Render a Business Associate tracker table listing each vendor, the service they provide, their BAA status (Verified / Stale / Missing), and their risk level.
• FR13: Compute and display the count of vendors whose BAA is missing or not verified within the current year.
• FR14: All data must load from sample-data.json via fetch() with no server-side dependency.

User stories

• As a practice manager, I want to see which of my current safeguards are about to become legally required, so that I can budget for them before the rule finalizes.
• As a practice manager, I want to click through my checklist and mark items done, so that I can track progress without a spreadsheet.
• As a practice manager, I want to see my open items sorted by priority and cost, so that I know what to tackle first with a limited budget.
• As an office administrator, I want to see which vendors don't have a current, verified BAA, so that I can close my biggest third-party risk gaps.
• As an owner-practitioner, I want a single readiness percentage I can show my insurance broker or accountant, so that I have a defensible answer when asked about compliance status.
• As a first-time visitor, I want to filter the checklist by category, so that I can focus on just the technical or just the administrative controls in one sitting.

Non-functional requirements

• Runs entirely client-side; no account creation, no external API calls, no PII collected or transmitted.
• Loads and becomes interactive in under 1 second on a typical broadband connection.
• Responsive layout usable on a tablet or laptop screen (this is an office-desk tool, not primarily mobile).
• All interactive controls (filters, status pills) are real <button> elements, keyboard-focusable and screen-reader labeled.
• Sample data is clearly fictional (placeholder practice and vendor names) and the footer states the prototype is not legal or compliance advice.

Out of scope (for the prototype)

• User accounts, authentication, or multi-practice data storage.
• A guided intake questionnaire that generates a custom checklist per practice.
• File uploads or an evidence vault for storing actual policy documents or scan reports.
• Integrations with real MFA, vulnerability-scanning, or EHR vendors.
• Automated email/SMS reminders for upcoming deadlines.

Open questions

• Once HHS publishes a final rule, how quickly can the checklist and countdown context be updated to reflect the real effective and compliance dates?
• Should pricing scale by staff count, by location count, or flat-rate per practice?
• Would practices trust a self-serve tool for something with six-figure fine exposure, or does this need a "compliance advisor reviews your answers" layer to be credible?