Source profileQuality 80/100

affaan-m/ECC/skills/hipaa-compliance/SKILL.md

hipaa-compliance

HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

Source repository stars
234,327
Declared platforms
0
Static risk flags
0
Last source update
2026-07-27
Source checked
2026-07-28
DecisionCompatibilityInstallWorkflowPermissionsEvidenceSource

Decision brief

What it does—and where it fits

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:

Best for

  • The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
  • Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
  • Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure

Not for

  • Tasks that require unconfirmed production actions or broad system permissions.
  • Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

PlatformStatusEvidenceWhat to check
CodexNot declaredNo explicit evidencePortability before use
Claude CodeNot declaredNo explicit evidencePortability before use
CursorNot declaredNo explicit evidencePortability before use
Gemini CLINot declaredNo explicit evidencePortability before use
Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource
npx skills add https://github.com/affaan-m/ECC --skill "skills/hipaa-compliance"
Safe inspection promptEditorial

Inspect the Agent Skill "hipaa-compliance" from https://github.com/affaan-m/ECC/blob/4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38/skills/hipaa-compliance/SKILL.md at commit 4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

  1. 01

    When to Use

    The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs

    The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAsBuilding or reviewing US healthcare software that stores, processes, exports, or transmits PHIAssessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
  2. 02

    How It Works

    Treat HIPAA as an overlay on top of the broader healthcare privacy skill:

    Start with healthcare-phi-compliance for the concrete implementation rules.Apply HIPAA-specific decision gates:Is this data PHI?
  3. 03

    HIPAA-Specific Guardrails

    Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.

    Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
  4. 04

    Examples

    Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.

    Activate hipaa-complianceUse healthcare-phi-compliance to review PHI movement, logging, storage, and prompt boundariesVerify whether the summarization provider is covered by a BAA before any PHI is sent

Permission review

Static risk signals and limitations

No configured static risk pattern was detected

This is not proof of safety. Runtime behavior, indirect dependencies, and hidden external systems are outside the static scan.

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial
SignalValueEvidence typeMeaning
Quality score80/100ComputedDocumentation, specificity, maintenance, and trust rules
Repository stars234,327SourceRepository attention, not individual Skill quality
Compatibility0 platformsSourceDeclared in the catalog source record
Usage guideautomated source guideEditorialGenerated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository
affaan-m/ECC
Skill path
skills/hipaa-compliance/SKILL.md
Commit
4e973d3eaf92d97f8d2e2d8abb39d8bdc8711b38
License
MIT
Collected
2026-07-28
Default branch
main
View the original SKILL.md

HIPAA Compliance

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:

  • healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.
  • healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.
  • security-review still applies for general auth, input-handling, secrets, API, and deployment hardening.

When to Use

  • The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
  • Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
  • Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
  • Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter

How It Works

Treat HIPAA as an overlay on top of the broader healthcare privacy skill:

  1. Start with healthcare-phi-compliance for the concrete implementation rules.
  2. Apply HIPAA-specific decision gates:
    • Is this data PHI?
    • Is this actor a covered entity or business associate?
    • Does a vendor or model provider require a BAA before touching the data?
    • Is access limited to the minimum necessary scope?
    • Are read/write/export events auditable?
  3. Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture.

HIPAA-Specific Guardrails

  • Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
  • Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.
  • Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
  • Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
  • Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.
  • Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.

Examples

Example 1: Product request framed as HIPAA

User request:

Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.

Response pattern:

  • Activate hipaa-compliance
  • Use healthcare-phi-compliance to review PHI movement, logging, storage, and prompt boundaries
  • Verify whether the summarization provider is covered by a BAA before any PHI is sent
  • Escalate to healthcare-reviewer if the summaries influence clinical decisions

Example 2: Vendor/tooling decision

User request:

Can we send support transcripts and patient messages into our analytics stack?

Response pattern:

  • Assume those messages may contain PHI
  • Block the design unless the analytics vendor is approved for HIPAA-bound workloads and the data path is minimized
  • Require redaction or a non-PHI event model when possible

Related Skills

  • healthcare-phi-compliance
  • healthcare-reviewer
  • healthcare-emr-patterns
  • healthcare-eval-harness
  • security-review

Alternatives

Compare before choosing

Computed 61234,327

affaan-m/ECC

hipaa-compliance

Review hipaa-compliance's use cases, installation, workflow, and original source instructions.

2026-07-270 platforms