Agent skill · data analytics · affaan-m
healthcare-phi-compliance
Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak vectors such as logs, URLs, and browser storage. Use when code touches patient or clinician data, when implementing HIPAA or GDPR access controls, or when auditing a healthcare system for data exposure.
Why this skill is useful
Provides specific compliance patterns and SQL commands for protecting PHI and PII in healthcare applications that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Healthcare PHI/PII Compliance Patterns Patterns for protecting patient data, clinician data, and financial data in healthcare applications. Applicable to HIPAA (US), DISHA (India), GDPR (EU), and general healthcare data protection. When to Use Building any feature that touches patient records Implementing access control or authentication for clinical systems Designing database schemas for healthcare data Building APIs that return patient or clinician data Implementing audit trails or logging Reviewing code for data exposure vulnerabilities Setting up Row-Level Security (RLS) for multi-tenant healthcare systems How It Works Healthcare data protection operates on three layers: classification (what is sensitive), access control (who can see it), and audit (who did see it). Data Classification PHI (Protected Health Information) — any data that can identify a patient AND relates to their health: patient name, date of birth, address, phone, email, national ID numbers (SSN, Aadhaar, NHS number), medical record numbers, diagnoses, medications, lab results, imaging, insurance policy and claim details, appointment and admission records, or any combination of the above. PII (Non-patient-sensitive data) in healthcare systems: clinician/staff personal details, doctor fee structures and payout amounts, employee salary and bank details, vendor payment information. Access Control: Row-Level Security Audit Trail Every PHI access or modification must be logged: Common Leak Vectors Error messages: Never include patient-identifying data in error messages thrown to the client. Log details server-side only. Console output: Never log full patient objects. Use opaque internal record IDs (UUIDs) — not medical record numbers, national IDs, or names. URL parameters: Never put patient-identifying data in query strings or path segments that could appear in logs or browser history. Use opaque UUIDs only. Browser storage: Never store PHI in localStorage or sessionStorage. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/healthcare-phi-compliance--ec36e1