hipaa-compliance

原文涵盖的主题

• HIPAA Compliance
• When to Use
• How It Works
• HIPAA-Specific Guardrails
• Examples
• Example 1: Product request framed as HIPAA
• Example 2: Vendor/tooling decision
• Related Skills

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical: healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention. healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass. security-review still applies for general auth, input-handling, secrets, API, and deployment hardening. The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter Treat HIPAA as an overlay on top of the broader healthcare privacy skill: 1. Start with healthcare-phi-compliance for the concrete implementation rules. 2. Apply HIPAA-specific decision gates: Is this data PHI? Is this actor a covered entity or business ass

这里只展示节选，请以完整原文和当前要求为准。