Hipaa Compliance
- 4.2k installs
- 238k repo stars
- Updated August 5, 2026
- affaan-m/everything-claude-code
HIPAA compliance is achieved when PHI handling, vendor relationships, audit trails, and data access controls meet US healthcare regulatory gates.
About
HIPAA Compliance is a specialized entrypoint for building or reviewing US healthcare systems subject to HIPAA regulations. It provides decision gates for identifying PHI (Protected Health Information), validating covered entity and business associate relationships, and enforcing data protection controls. Developers use this skill when designing patient-facing or clinician systems, evaluating third-party vendor BAA requirements, and auditing data flows. The skill chains `healthcare-phi-compliance` for concrete implementation rules (encryption, audit logging, PII classification), `healthcare-reviewer` for clinical workflow and patient safety assessment, and `security-review` for authentication and secrets hardening. Core guardrails include blocking PHI from logs, analytics, prompts, and error strings; requiring audit trails for all PHI reads/writes; enforcing minimum necessary access; and treating SaaS/LLM providers as blocked until BAA status is confirmed. Decision gates for PHI identification, covered entity classification, BAA vendor approval, and minimum necessary access scope.
- Decision gates for PHI identification, covered entity classification, BAA vendor approval, and minimum necessary access
- Blocks PHI from logs, analytics, crash reports, LLM prompts, URLs, and client-visible error messages
- Chains healthcare-phi-compliance for encryption and audit logging, healthcare-reviewer for clinical safety, security-rev
- Requires authenticated access, scoped authorization, and audit trails for all PHI read/write/export operations
- Third-party vendors (SaaS, observability, support, LLM) blocked by default until BAA status and data boundaries confirme
Hipaa Compliance by the numbers
- 4,196 all-time installs (skills.sh)
- +223 installs in the week ending Aug 5, 2026 (Skillselion tracking)
- Ranked #144 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: LOW risk (skills.sh audit)
- Data as of Aug 5, 2026 (Skillselion catalog sync)
hipaa-compliance capabilities & compatibility
- Capabilities
- phi identification and classification · covered entity and business associate assessment · baa vendor approval gating · audit trail and logging design · minimum necessary access enforcement
- Works with
- github · jira · confluence
- Use cases
- security audit · code review
- Platforms
- macOS · Windows · Linux
- Runs
- Local or remote
- Pricing
- Free
What hipaa-compliance says it does
Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
npx skills add https://github.com/affaan-m/everything-claude-code --skill hipaa-complianceAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 4.2k |
|---|---|
| repo stars | ★ 238k |
| Security audit | 3 / 3 scanners passed |
| Last updated | August 5, 2026 |
| Repository | affaan-m/everything-claude-code ↗ |
What it does
Implement HIPAA compliance controls for US healthcare software handling PHI and patient data.
Who is it for?
Building patient or clinician-facing healthcare products; reviewing vendor and LLM integrations for BAA eligibility; auditing data flows in regulated healthcare systems.
Skip if: Non-US healthcare systems; non-regulated patient data; systems handling no PHI; open-source community tools without compliance requirements.
When should I use this skill?
Request explicitly mentions HIPAA, PHI, covered entities, business associates, BAAs, or US healthcare compliance requirements.
What you get
System demonstrates covered entity or BAA-compliant architect, blocks PHI from logs and prompts, enforces audit trails, and limits vendor exposure.
- HIPAA compliance decision checklist
- Audit trail and logging architecture
- Vendor BAA assessment and approval gate
By the numbers
- Skill provides decision gates across PHI identification, covered entity classification, BAA vendor approval, and minimum
Files
HIPAA Compliance
Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:
healthcare-phi-complianceremains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.healthcare-reviewerremains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.security-reviewstill applies for general auth, input-handling, secrets, API, and deployment hardening.
When to Use
- The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
- Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
- Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
- Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter
How It Works
Treat HIPAA as an overlay on top of the broader healthcare privacy skill:
1. Start with healthcare-phi-compliance for the concrete implementation rules. 2. Apply HIPAA-specific decision gates:
- Is this data PHI?
- Is this actor a covered entity or business associate?
- Does a vendor or model provider require a BAA before touching the data?
- Is access limited to the minimum necessary scope?
- Are read/write/export events auditable?
3. Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture.
HIPAA-Specific Guardrails
- Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
- Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.
- Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
- Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
- Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.
- Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.
Examples
Example 1: Product request framed as HIPAA
User request:
Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.
Response pattern:
- Activate
hipaa-compliance - Use
healthcare-phi-complianceto review PHI movement, logging, storage, and prompt boundaries - Verify whether the summarization provider is covered by a BAA before any PHI is sent
- Escalate to
healthcare-reviewerif the summaries influence clinical decisions
Example 2: Vendor/tooling decision
User request:
Can we send support transcripts and patient messages into our analytics stack?
Response pattern:
- Assume those messages may contain PHI
- Block the design unless the analytics vendor is approved for HIPAA-bound workloads and the data path is minimized
- Require redaction or a non-PHI event model when possible
Related Skills
healthcare-phi-compliancehealthcare-reviewerhealthcare-emr-patternshealthcare-eval-harnesssecurity-review
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85Forks & variants (1)
Hipaa Compliance has 1 known copy in the catalog totaling 1.4k installs. They canonicalize to this original listing.
- affaan-m - 1.4k installs
FAQ
Can I place PHI in logs, analytics, or prompts?
No. HIPAA guardrails strictly prohibit PHI in logs, analytics events, crash reports, LLM prompts, URLs, browser storage, and client-visible error strings.
When do I need a BAA with a vendor?
Any third-party SaaS, observability, support, or LLM provider that touches PHI requires a signed BAA. Treat all vendors as blocked by default until BAA status is confirmed.
What skills should I chain with hipaa-compliance?
Chain healthcare-phi-compliance for encryption and audit logging, healthcare-reviewer for clinical safety impact, and security-review for auth and secrets hardening.
Is Hipaa Compliance safe to install?
skills.sh reports 3 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.