New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Healthcare Phi Compliance

by affaan-m in affaan-m/ECC

Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak…

MITAuto-check passedLegal & Compliance

Install Healthcare Phi Compliance

skills CLI
$ npx skills add affaan-m/ECC --skill healthcare-phi-compliance -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install affaan-m/ECC healthcare-phi-compliance --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/healthcare-phi-compliance .claude/skills/healthcare-phi-compliance && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
healthcare-phi-compliance
GitHub stars
277k
Used in
1 other repo
Token cost
~1.4k tokens
SKILL.md length
417 words
Files
1
Skills in repo
683
Repo updated
First seen
Licence
MIT

At a glance

Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak…

  • Code touches patient
  • SKILL.md covers When to Use, How It Works and Examples
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Implementing HIPAA

What it does

Healthcare Phi Compliance is an agent skill from affaan-m/ECC. Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak vectors such as logs, URLs, and browser storage. Use when code touches patient or clinician data, when implementing HIPAA or GDPR access controls, or when auditing a healthcare system for data exposure.

Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Legal & Compliance, covering Authorization and RBAC, Privacy and GDPR and Healthcare and finance regulation. The repository describes itself as: The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. The licence is MIT.

When your agent uses it

  • Code touches patient
  • Implementing HIPAA
  • GDPR access controls
  • Auditing a healthcare system for data exposure

Example prompts

  • “/healthcare-phi-compliance”

What it can do on your machine

Read from SKILL.md and the folder at commit 2d515e4. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are sql and typescript).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Healthcare Phi Compliance loads about 1.4k tokens when it runs. Until then it costs about 107 tokens; SKILL.md has 417 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~107
When it runs · the whole SKILL.md, loaded when a task matches
~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from affaan-m/ECC at commit 2d515e4, republished under its MIT licence (© affaan-m). 417 words, ~1,435 tokens.

Download SKILL.mdSave it as .claude/skills/healthcare-phi-compliance/SKILL.md (or your agent's skills folder).
name
healthcare-phi-compliance
description
Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak vectors such as logs, URLs, and browser storage. Use when code touches patient or clinician data, when implementing HIPAA or GDPR access controls, or when auditing a healthcare system for data exposure.
metadata.version
1.0.0
metadata.origin
Health1 Super Speciality Hospitals — contributed by Dr. Keyur Patel

Healthcare PHI/PII Compliance Patterns

Patterns for protecting patient data, clinician data, and financial data in healthcare applications. Applicable to HIPAA (US), DISHA (India), GDPR (EU), and general healthcare data protection.

When to Use

  • Building any feature that touches patient records
  • Implementing access control or authentication for clinical systems
  • Designing database schemas for healthcare data
  • Building APIs that return patient or clinician data
  • Implementing audit trails or logging
  • Reviewing code for data exposure vulnerabilities
  • Setting up Row-Level Security (RLS) for multi-tenant healthcare systems

How It Works

Healthcare data protection operates on three layers: classification (what is sensitive), access control (who can see it), and audit (who did see it).

Data Classification

PHI (Protected Health Information) — any data that can identify a patient AND relates to their health: patient name, date of birth, address, phone, email, national ID numbers (SSN, Aadhaar, NHS number), medical record numbers, diagnoses, medications, lab results, imaging, insurance policy and claim details, appointment and admission records, or any combination of the above.

PII (Non-patient-sensitive data) in healthcare systems: clinician/staff personal details, doctor fee structures and payout amounts, employee salary and bank details, vendor payment information.

Access Control: Row-Level Security
sql
ALTER TABLE patients ENABLE ROW LEVEL SECURITY;

-- Scope access by facility
CREATE POLICY "staff_read_own_facility"
  ON patients FOR SELECT TO authenticated
  USING (facility_id IN (
    SELECT facility_id FROM staff_assignments
    WHERE user_id = auth.uid() AND role IN ('doctor','nurse','lab_tech','admin')
  ));

-- Audit log: insert-only (tamper-proof)
CREATE POLICY "audit_insert_only" ON audit_log FOR INSERT
  TO authenticated WITH CHECK (user_id = auth.uid());
CREATE POLICY "audit_no_modify" ON audit_log FOR UPDATE USING (false);
CREATE POLICY "audit_no_delete" ON audit_log FOR DELETE USING (false);
Audit Trail

Every PHI access or modification must be logged:

typescript
interface AuditEntry {
  timestamp: string;
  user_id: string;
  patient_id: string;
  action: 'create' | 'read' | 'update' | 'delete' | 'print' | 'export';
  resource_type: string;
  resource_id: string;
  changes?: { before: object; after: object };
  ip_address: string;
  session_id: string;
}
Show full SKILL.md (216 more words)Show less
Common Leak Vectors

Error messages: Never include patient-identifying data in error messages thrown to the client. Log details server-side only.

Console output: Never log full patient objects. Use opaque internal record IDs (UUIDs) — not medical record numbers, national IDs, or names.

URL parameters: Never put patient-identifying data in query strings or path segments that could appear in logs or browser history. Use opaque UUIDs only.

Browser storage: Never store PHI in localStorage or sessionStorage. Keep PHI in memory only, fetch on demand.

Service role keys: Never use the service_role key in client-side code. Always use the anon/publishable key and let RLS enforce access.

Logs and monitoring: Never log full patient records. Use opaque record IDs only (not medical record numbers). Sanitize stack traces before sending to error tracking services.

Database Schema Tagging

Mark PHI/PII columns at the schema level:

sql
COMMENT ON COLUMN patients.name IS 'PHI: patient_name';
COMMENT ON COLUMN patients.dob IS 'PHI: date_of_birth';
COMMENT ON COLUMN patients.aadhaar IS 'PHI: national_id';
COMMENT ON COLUMN doctor_payouts.amount IS 'PII: financial';
Deployment Checklist

Before every deployment:

  • No PHI in error messages or stack traces
  • No PHI in console.log/console.error
  • No PHI in URL parameters
  • No PHI in browser storage
  • No service_role key in client code
  • RLS enabled on all PHI/PII tables
  • Audit trail for all data modifications
  • Session timeout configured
  • API authentication on all PHI endpoints
  • Cross-facility data isolation verified

Examples

Example 1: Safe vs Unsafe Error Handling
typescript
// BAD — leaks PHI in error
throw new Error(`Patient ${patient.name} not found in ${patient.facility}`);

// GOOD — generic error, details logged server-side with opaque IDs only
logger.error('Patient lookup failed', { recordId: patient.id, facilityId });
throw new Error('Record not found');
Example 2: RLS Policy for Multi-Facility Isolation
sql
-- Doctor at Facility A cannot see Facility B patients
CREATE POLICY "facility_isolation"
  ON patients FOR SELECT TO authenticated
  USING (facility_id IN (
    SELECT facility_id FROM staff_assignments WHERE user_id = auth.uid()
  ));

-- Test: login as doctor-facility-a, query facility-b patients
-- Expected: 0 rows returned
Example 3: Safe Logging
typescript
// BAD — logs identifiable patient data
console.log('Processing patient:', patient);

// GOOD — logs only opaque internal record ID
console.log('Processing record:', patient.id);
// Note: even patient.id should be an opaque UUID, not a medical record number

© affaan-m, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/healthcare-phi-compliance of affaan-m/ECC.

Open the folder on GitHubat commit 2d515e4

Used in 1 other repository

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in affaan-m/ECC, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Healthcare Phi Compliance next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Healthcare Phi Compliance compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Healthcare Phi Compliance this skillaffaan-m/ECC277k1 repos~1.4kAutomated safety check: PassMIT
Policy OpaAgentSecOps/SecOpsAgentKit2201 repos~3.5kAutomated safety check: PassCustom licence
Hipaa Employee Trainingmukul975/Privacy-Data-Protection-Skills301—~1.9kAutomated safety check: PassApache-2.0
Hipaa Research Privacymukul975/Privacy-Data-Protection-Skills301—~1.7kAutomated safety check: PassApache-2.0
Purpose Based Accessmukul975/Privacy-Data-Protection-Skills301—~3.9kAutomated safety check: PassApache-2.0
HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed5.5k—~1.7kAutomated safety check: PassApache-2.0

Similar skills

  • Policy Opa

    AgentSecOps/SecOpsAgentKit

    Policy-as-code enforcement and compliance validation using Open Policy Agent (OPA).

    220 GitHub starsUsed in 1 repo~3.5k tokens
    Legal & ComplianceAuto-check passed

  • Hipaa Employee Training

    mukul975/Privacy-Data-Protection-Skills

    Implements HIPAA workforce training requirements under 45 CFR §164.530(b) (Privacy Rule) and 45 CFR §164.308(a)(5) (Security Rule).

    301 GitHub stars~1.9k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • Hipaa Research Privacy

    mukul975/Privacy-Data-Protection-Skills

    Implements HIPAA Privacy Rule requirements for research uses of protected health information under 45 CFR §164.512(i).

    301 GitHub stars~1.7k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • Purpose Based Access

    mukul975/Privacy-Data-Protection-Skills

    Design and implement Purpose-Based Access Control (PBAC) architecture including purpose ontology definition, policy engine configuration, audit logging of purpose verification at query time, and…

    301 GitHub stars~3.9k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • HIPAA Safe Harbor Coverage Audit

    maziyarpanahi/openmed

    Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.

    5.5k GitHub stars~1.7k tokensUpdated today
    Legal & ComplianceAuto-check passed

  • Hipaa Compliance

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert HIPAA compliance assistant for healthcare and software contexts.

    946 GitHub starsUsed in 1 repo~2.3k tokens
    Legal & ComplianceAuto-check passed

More from affaan-m/ECC

All 682 skills in this repo

  • Skill Stocktake

    affaan-m/ECC

    Audits your installed Claude skills and commands for quality, with a quick mode for recently changed skills and a full mode that evaluates all of them through subagents.

    277k GitHub starsUsed in 5 repos~3.1k tokens
    Auto-check passed

  • VideoDB Video Search and Editing

    affaan-m/ECC

    Ingests, indexes, searches, edits and monitors video, audio and live streams through the VideoDB Python SDK, returning stream links, clips and timestamps.

    277k GitHub starsUsed in 3 repos~3.5k tokens
    Auto-check: notes

  • Docs Governance

    affaan-m/ECC

    Route broad documentation-governance requests to existing ECC skills and run an opt-in, read-only audit of mapped documentation roles, links, ADR indexes, and evidence references.

    277k GitHub stars~1.1k tokensUpdated today
    Auto-check passed

  • Rules Distillation

    affaan-m/ECC

    Scans installed skills for principles that recur across them and proposes rule-file changes: append, revise, add a section, create a file or leave as covered.

    277k GitHub starsUsed in 2 repos~2.3k tokens
    Auto-check passed

  • Master Agreement Generator

    affaan-m/ECC

    Builds DRAFT counterparty agreements from one markdown template and a small JSON spec per party, with clauses picked by the party's role.

    277k GitHub stars~2.9k tokensUpdated today
    Auto-check passed

  • Frontend Design Direction

    affaan-m/ECC

    Set an ECC-specific frontend design direction for production UI work.

    277k GitHub starsUsed in 1 repo~2.2k tokens
    Auto-check passed

Categories

Questions about Healthcare Phi Compliance

What does Healthcare Phi Compliance do?

Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak…. Healthcare Phi Compliance is an agent skill from affaan-m/ECC. Protected Health Information (PHI) and PII compliance patterns for healthcare applications: data classification, row-level access control, tamper-proof audit trails, schema tagging, and common leak vectors such as logs, URLs, and browser storage.

When should I use Healthcare Phi Compliance?

Healthcare Phi Compliance fits situations like: code touches patient; implementing HIPAA; GDPR access controls; auditing a healthcare system for data exposure.

How do I install Healthcare Phi Compliance in Claude Code?

Run `npx skills add affaan-m/ECC --skill healthcare-phi-compliance -a claude-code`. Or copy the skill folder (skills/healthcare-phi-compliance in affaan-m/ECC) into .claude/skills/healthcare-phi-compliance in your project. Claude Code loads it when a task matches its description.

How do I install Healthcare Phi Compliance in Codex?

Run `npx skills add affaan-m/ECC --skill healthcare-phi-compliance -a codex`. Or copy the skill folder (skills/healthcare-phi-compliance in affaan-m/ECC) into .agents/skills/healthcare-phi-compliance in your project. Codex loads it when a task matches its description.

Can I use Healthcare Phi Compliance in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add affaan-m/ECC --skill healthcare-phi-compliance -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/healthcare-phi-compliance, .gemini/skills/healthcare-phi-compliance, .github/skills/healthcare-phi-compliance and .opencode/skills/healthcare-phi-compliance in your project.

What does Healthcare Phi Compliance need to run?

SKILL.md names no scripts, command-line tools or credentials: Healthcare Phi Compliance is instructions for the agent only.

Does Healthcare Phi Compliance access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Healthcare Phi Compliance safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Healthcare Phi Compliance use?

Healthcare Phi Compliance is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Healthcare Phi Compliance use?

About 1.4k tokens (SKILL.md is roughly 5.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Healthcare Phi Compliance?

Skills that share tags, products or a category with Healthcare Phi Compliance: Policy Opa (AgentSecOps/SecOpsAgentKit, 220 stars), Hipaa Employee Training (mukul975/Privacy-Data-Protection-Skills, 301 stars), Hipaa Research Privacy (mukul975/Privacy-Data-Protection-Skills, 301 stars) and Purpose Based Access (mukul975/Privacy-Data-Protection-Skills, 301 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Healthcare Phi Compliance?

affaan-m (a GitHub user) maintains it in affaan-m/ECC, which has 276,673 GitHub stars. The repository holds 683 skills in this directory. The repository was last updated on October 11, 2026.

Source: affaan-m/ECC on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.