# UnitAutogen HIPAA tool automates security testing for Supabase PostgreSQL schemas

> **Key takeaway:** A new tool for the UnitAutogen Enterprise edition allows developers to programmatically verify HIPAA compliance requirements like Row Level Security and audit logging within Supabase environments.

**Published:** 2026-10-29T12:00:00+00:00 
**Source:** Planet PostgreSQL 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/unitautogen-hipaa-tool-automates-security-testing-for-supaba.html 

## Summary
While Supabase provides platform-level HIPAA compliance through encryption and Business Associate Agreements (BAAs), developers remain responsible for the security of their specific SQL implementations. This includes managing Row Level Security (RLS) policies, database functions, and audit tables to ensure Protected Health Information (PHI) is handled correctly.

To address this shared responsibility, the unitautogen hipaa tool has been introduced. It operates on local Supabase stacks using existing migrations to generate and execute security tests without touching real patient data. The tool produces detailed reports to help engineers provide evidence of access control, audit integrity, and protection against data tampering during regulatory reviews.

## Technical verification of database security controls
- **Access Control Validation:** The tool tests if functions, views, or triggers running as an owner bypass RLS policies by executing calls as different tenants and reporting potential data leaks.
- **Audit Log Verification:** It checks every PHI table for insert, update, and delete operations to ensure changes are recorded in audit tables, distinguishing between recorded, conditional, or untested changes.
- **Tamper Resistance Testing:** The utility identifies if client roles can modify or forge audit logs, specifically flagging risks like SECURITY DEFINER functions exposed via .rpc() that allow unauthorized writes.
- **Identity and Session Integrity:** It validates whether client sessions can manipulate auth.uid() or auth.jwt() values, which are critical for the identity-based policies used in Supabase.
- **Automated Reporting:** The tool generates HTML and JSON reports containing SHA-256 hashes of all source files to ensure the integrity of the evidence provided to auditors.

## Why it matters
This development provides software engineers building healthcare applications on Supabase a way to integrate compliance testing directly into CI/CD pipelines via GitHub Actions. By automating the verification of RLS and audit triggers, teams can maintain continuous compliance as their database schemas evolve through migrations.