Agent skill · security · affaan-m
hipaa-compliance
HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.
Why this skill is useful
Provides specific HIPAA compliance guidelines and decision gates that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
HIPAA Compliance Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical: healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention. healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass. security-review still applies for general auth, input-handling, secrets, API, and deployment hardening. When to Use The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter How It Works Treat HIPAA as an overlay on top of the broader healthcare privacy skill: 1. Start with healthcare-phi-compliance for the concrete implementation rules. 2. Apply HIPAA-specific decision gates: Is this data PHI? Is this actor a covered entity or business associate? Does a vendor or model provider require a BAA before touching the data? Is access limited to the minimum necessary scope? Are read/write/export events auditable? 3. Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture. HIPAA-Specific Guardrails Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings. Never expose PHI in URLs, browser storage, screenshots, or copied example payloads. Require authenticated access, scoped authorization, and audit trails for PHI reads and writes. Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/hipaa-compliance--e11379