stetteh/regmap-embedder

RegMap — NIST SP 800-53 → HIPAA Security Rule mapping model

RegMap is a fine-tuned sentence-embedding model that maps a NIST SP 800-53 security control to the most relevant HIPAA Security Rule provisions. Given a control description, it retrieves the HIPAA citations whose meaning is closest — helping compliance teams cross-walk a NIST-based control set onto HIPAA without manual, line-by-line mapping.

• Base model: sentence-transformers/all-MiniLM-L6-v2 (6-layer MiniLM, 384-dim embeddings)
• Fine-tuning: MultipleNegativesRankingLoss on curated NIST↔HIPAA control/provision pairs
• Task: semantic retrieval (embed a control, cosine-rank against the HIPAA corpus, return top-k)

Where to get it

• Hugging Face: stetteh/regmap-embedder — SentenceTransformer("stetteh/regmap-embedder")
• Docker (serving API): docker run -p 8080:8080 ghcr.io/samuelgtetteh/regmap-embedder:0.1 then POST /map {"control": "..."} → top-k HIPAA provisions
• GitHub Release: v0.1-regmap — a self-contained archive (model + corpus + wrapper)

Intended use — an assistive retriever, not an authoritative classifier

RegMap returns the top-k most similar HIPAA provisions for a human to review and confirm. It is designed to accelerate an expert's mapping work, not to make a final compliance determination on its own. Always have a qualified person verify the suggested citations.

How to use

Quick start (bundled wrapper — includes the HIPAA corpus)

pip install -r requirements.txt
python example.py
# or:
python regmap_map.py "Enforce multi-factor authentication for remote access."

from regmap_map import map_control
for r in map_control("Employ integrity verification tools to detect unauthorized changes.", top_k=5):
    print(f"{r['score']:.3f}  {r['hipaa_citation']}")

Use the raw embedder (sentence-transformers)

from sentence_transformers import SentenceTransformer, util
m = SentenceTransformer("path/to/regmap-embedder")
q = m.encode("The organization enforces multi-factor authentication for remote access.",
             convert_to_tensor=True, normalize_embeddings=True)
# encode your HIPAA provision texts and cosine-rank against q

Evaluation

Measured on a held-out set of positive NIST↔HIPAA pairs (small, domain-specific dataset):

Metric	Value
Recall@1	0.265
Recall@3	0.559
Recall@5	0.735
MRR	0.463
Positive pairs	222

Read this as: the correct HIPAA provision is in the top-5 about 74% of the time — appropriate for a top-k assistive tool where a human confirms the result. Top-1 accuracy is modest (~26%), so it should not be used as a single-answer classifier.

Training data

Curated NIST SP 800-53 control texts paired with HIPAA Security Rule provisions (hipaa_citation + hipaa_text). The bundled hipaa_corpus.csv is the HIPAA provision corpus used for retrieval.

Limitations

• Small, HIPAA-specific training set → best treated as an assistive top-k retriever.
• Covers the HIPAA Security Rule provisions in the bundled corpus; other frameworks (PCI, GDPR) are out of scope for this release.
• Semantic similarity ≠ legal equivalence; a suggested citation still needs expert confirmation.

License

Apache-2.0 (inherited from the base model all-MiniLM-L6-v2). See LICENSE.

Citation

Tetteh, S. G. RegMap: Semantic mapping of NIST SP 800-53 controls to HIPAA Security Rule provisions. Jarvis College of Computing and Digital Media, DePaul University.

If you use this model, please cite the RegMap work above.