Hipaa Compliance

This is the entrypoint skill when someone explicitly mentions HIPAA, covered entities, or business associate agreements. It stays intentionally thin and acts as a routing layer: it activates healthcare-phi-compliance for the actual implementation rules around PHI handling, logging, and encryption, then applies HIPAA-specific decision gates on top like "does this vendor have a BAA?" and "is access limited to minimum necessary?" The smart move here is treating HIPAA as an overlay rather than reimplementing privacy rules from scratch. Use it when the request is framed around US healthcare compliance, and let it escalate to healthcare-reviewer when clinical workflows or production architecture are involved.

skills.sh installs: 3.6K
GitHub stars: 229.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/everything-claude-code --skill hipaa-compliance --agent claude-code

Installs into .claude/skills of the current project.

Files

HIPAA Compliance

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:

healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.
healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.
security-review still applies for general auth, input-handling, secrets, API, and deployment hardening.

When to Use

The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter