Agent skill · security · erichowens
hipaa-compliance
Ensure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates
Why this skill is useful
Provides specific audit logging patterns and security requirements for handling PHI that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-07-14. 180 stars on the source repository.
What this skill does
HIPAA Compliance for Recovery Coach This skill helps you maintain HIPAA compliance when developing features that handle Protected Health Information (PHI). What is PHI in This Application? Data Type PHI Status Handling ----------- ------------ ---------- Check-in mood/cravings PHI Audit all access Journal entries PHI Audit all access Chat conversations PHI Audit all access User profile (name, email) PHI Audit modifications Sobriety date PHI Audit access Emergency contacts PHI Audit access Usage analytics (aggregated) NOT PHI No audit needed Page views (no content) NOT PHI No audit needed Audit Logging Requirements When to Log Always log these operations: Viewing any PHI (check-ins, journal, messages) Creating/updating/deleting PHI Exporting user data Admin access to user information Failed authentication attempts Security events (rate limiting, unauthorized access) How to Log Use the audit logging utilities in src/lib/hipaa/audit.ts: Data Sanitization Never Log These Fields The audit system automatically sanitizes, but be explicit: Sanitized Fields (Auto-Redacted) password, token, secret, key authorization, cookie, session credential, content, message, notes Session Security Requirements From src/lib/auth.ts: Session timeout: 15 minutes of inactivity (HIPAA requirement) Max session: 8 hours absolute maximum Failed login lockout: 5 attempts = 30 minute ban Password requirements: 12+ chars, mixed case, numbers, special chars Code Patterns API Route with Audit Logging Component with PHI Access Compliance Checklist Before shipping any feature that touches PHI: [ ] All PHI access is audit logged [ ] No PHI content in logs (only IDs and metadata) [ ] Data access requires authentication [ ] Admin access has separate audit trail [ ] Failed access attempts are logged [ ] Data export includes audit entry [ ] Sensitive fields are encrypted at rest [ ] Session timeout is enforced Audit Log Retention Minimum: 6 years (HIPAA requirement) Format: Raw logs for 1 year, compressed th …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills erichowens/hipaa-compliance