hipaa-compliance

The hipaa-compliance skill serves as a HIPAA-focused entrypoint for healthcare privacy and security workflows involving protected health information (PHI), covered entities, business associates, and US healthcare compliance requirements. It helps teams evaluate whether software systems, workflows, integrations, or operational practices introduce HIPAA exposure when handling sensitive healthcare data. Rather than implementing all healthcare compliance logic directly, the skill acts as a canonical coordination layer that routes implementation concerns to related healthcare privacy and security skills while enforcing HIPAA-specific decision gates and compliance guardrails.

The skill emphasizes secure PHI handling, auditability, minimum necessary access, and vendor risk assessment. It guides users through evaluating whether data qualifies as PHI, whether involved actors are covered entities or business associates, and whether third-party vendors or model providers require a Business Associate Agreement (BAA) before data access is permitted. The skill also reinforces healthcare-specific safeguards such as preventing PHI leakage in logs, analytics events, crash reports, prompts, URLs, screenshots, browser storage, and example payloads. It requires authenticated and scoped access controls, audit trails for PHI reads and writes, and cautious treatment of third-party SaaS, observability platforms, support tooling, and LLM providers until data boundaries and BAA status are verified.

Typical use cases include reviewing healthcare software architectures, evaluating analytics and support tooling decisions, designing clinician-facing or patient-facing systems, and assessing AI-enabled healthcare workflows that may process PHI. The skill is intended for engineering teams, security reviewers, healthcare software developers, compliance teams, platform architects, and organizations building or operating HIPAA-sensitive systems in the United States. It is especially relevant when healthcare applications involve logging, AI summarization, data exports, vendor integrations, or regulated production infrastructure.