Hipaa Compliance

This is the routing layer for HIPAA work. It doesn't implement the compliance rules itself, it decides whether your task needs them and then delegates to healthcare-phi-compliance for the actual PHI handling, logging, and encryption patterns. Use it when the request explicitly mentions HIPAA, covered entities, BAAs, or US healthcare compliance. The skill adds decision gates on top of the broader healthcare privacy work: is this PHI, does the vendor have a BAA, is access scoped to minimum necessary, are events auditable. It keeps you from accidentally logging patient data in error messages or sending PHI to an LLM without the right contract in place. Thin by design, which is probably right for a compliance entry point.

skills.sh installs: 5.5K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill hipaa-compliance --agent claude-code

Installs into .claude/skills of the current project.

Files

HIPAA Compliance

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:

healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.
healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.
security-review still applies for general auth, input-handling, secrets, API, and deployment hardening.

When to Use

The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter