HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
HIPAA-specific entrypoint for healthcare privacy and security work.
Install Hipaa Compliance
$ npx skills add affaan-m/ECC --skill hipaa-compliance -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install affaan-m/ECC hipaa-compliance --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/hipaa-compliance .claude/skills/hipaa-compliance && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hipaa-compliance" agent skill from https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance into .claude/skills/hipaa-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-compliance", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/affaan-m/ECC/tree/main/skills/hipaa-complianceType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add affaan-m/ECC --skill hipaa-compliance -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install affaan-m/ECC hipaa-compliance --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/hipaa-compliance .agents/skills/hipaa-compliance && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hipaa-compliance" agent skill from https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance into .agents/skills/hipaa-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-compliance", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add affaan-m/ECC --skill hipaa-compliance -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install affaan-m/ECC hipaa-compliance --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/hipaa-compliance .cursor/skills/hipaa-compliance && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hipaa-compliance" agent skill from https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance into .cursor/skills/hipaa-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-compliance", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/affaan-m/ECC.git --path skills/hipaa-compliance--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add affaan-m/ECC --skill hipaa-compliance -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install affaan-m/ECC hipaa-compliance --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/hipaa-compliance .gemini/skills/hipaa-compliance && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hipaa-compliance" agent skill from https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance into .gemini/skills/hipaa-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-compliance", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install affaan-m/ECC hipaa-complianceInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add affaan-m/ECC --skill hipaa-compliance -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/hipaa-compliance .github/skills/hipaa-compliance && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hipaa-compliance" agent skill from https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance into .github/skills/hipaa-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-compliance", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add affaan-m/ECC --skill hipaa-compliance -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install affaan-m/ECC hipaa-compliance --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/affaan-m/ECC.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/hipaa-compliance .opencode/skills/hipaa-compliance && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hipaa-compliance" agent skill from https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance into .opencode/skills/hipaa-compliance/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-compliance", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
hipaa-compliance- GitHub stars
- 277k
- Used in
- 1 other repo
- Token cost
- ~908 tokens
- SKILL.md length
- 424 words
- Files
- 1
- Skills in repo
- 683
- Repo updated
- First seen
- Licence
- MIT
At a glance
HIPAA-specific entrypoint for healthcare privacy and security work.
- Works in 3 steps: Start with healthcare-phi-compliance for… → Apply HIPAA-specific decision gates → Escalate to healthcare-reviewer if the…
- A task is explicitly framed around HIPAA
- SKILL.md covers When to Use, How It Works, HIPAA-Specific Guardrails and Examples, plus 1 more section
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Hipaa Compliance is an agent skill from affaan-m/ECC. HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.
Its SKILL.md is about 910 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Legal & Compliance, covering Healthcare and finance regulation. The repository describes itself as: The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond. The licence is MIT.
When your agent uses it
- A task is explicitly framed around HIPAA
- Covered entities
- US healthcare compliance requirements
Example prompts
- “/hipaa-compliance”
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- Start with healthcare-phi-compliance for the concrete implementation rules.
- Apply HIPAA-specific decision gates
- Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture.
What it can do on your machine
Read from SKILL.md and the folder at commit 2d515e4. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Hipaa Compliance loads about 908 tokens when it runs. Until then it costs about 58 tokens; SKILL.md has 424 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from affaan-m/ECC at commit 2d515e4, republished under its MIT licence (© affaan-m). 424 words, ~908 tokens.
Download SKILL.mdSave it as
.claude/skills/hipaa-compliance/SKILL.md (or your agent's skills folder).- name
- hipaa-compliance
- description
- HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.
- metadata.version
- 1.0.0
- metadata.origin
- ECC direct-port adaptation
HIPAA Compliance
Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:
healthcare-phi-complianceremains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.healthcare-reviewerremains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.security-reviewstill applies for general auth, input-handling, secrets, API, and deployment hardening.
When to Use
- The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
- Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
- Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
- Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter
How It Works
Treat HIPAA as an overlay on top of the broader healthcare privacy skill:
- Start with
healthcare-phi-compliancefor the concrete implementation rules. - Apply HIPAA-specific decision gates:
- Is this data PHI?
- Is this actor a covered entity or business associate?
- Does a vendor or model provider require a BAA before touching the data?
- Is access limited to the minimum necessary scope?
- Are read/write/export events auditable?
- Escalate to
healthcare-reviewerif the task affects patient safety, clinical workflows, or regulated production architecture.
HIPAA-Specific Guardrails
- Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
- Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.
- Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
- Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
- Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.
- Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.
Show full SKILL.md (127 more words)Show less
Examples
Example 1: Product request framed as HIPAA
User request:
Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.
Response pattern:
- Activate
hipaa-compliance - Use
healthcare-phi-complianceto review PHI movement, logging, storage, and prompt boundaries - Verify whether the summarization provider is covered by a BAA before any PHI is sent
- Escalate to
healthcare-reviewerif the summaries influence clinical decisions
Example 2: Vendor/tooling decision
User request:
Can we send support transcripts and patient messages into our analytics stack?
Response pattern:
- Assume those messages may contain PHI
- Block the design unless the analytics vendor is approved for HIPAA-bound workloads and the data path is minimized
- Require redaction or a non-PHI event model when possible
Related Skills
healthcare-phi-compliancehealthcare-reviewerhealthcare-emr-patternshealthcare-eval-harnesssecurity-review
© affaan-m, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/hipaa-compliance of affaan-m/ECC.
Open the folder on GitHubat commit 2d515e4
Used in 1 other repository
We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in affaan-m/ECC, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Hipaa Compliance next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hipaa Compliance this skillaffaan-m/ECC | 277k | 1 repos | ~908 | Automated safety check: Pass | MIT | |
| HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed | 5.5k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| HIPAA Pre-Deployment Compliance Checkmaziyarpanahi/openmed | 5.5k | — | ~2k | Automated safety check: Pass | Apache-2.0 | |
| Hipaa ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 946 | 1 repos | ~2.3k | Automated safety check: Pass | MIT | |
| ISO Standards Readiness EvidenceK-Dense-AI/scientific-agent-skills | 48k | 1 repos | ~4.6k | Automated safety check: Notes | MIT | |
| Fda Consultant Specialistdavila7/claude-code-templates | 33k | 1 repos | ~2.7k | Automated safety check: Pass | MIT |
Similar skills
HIPAA Pre-Deployment Compliance Check
maziyarpanahi/openmed
Walks a data pipeline against the HIPAA Privacy and Security Rule checklist and produces a gap report before it processes patient data.
Hipaa Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert HIPAA compliance assistant for healthcare and software contexts.
ISO Standards Readiness Evidence
K-Dense-AI/scientific-agent-skills
Organizes scope, controlled documents, risk files and traceability into draft evidence for human review against ISO 13485, 14971, 17025 and 15189.
Fda Consultant Specialist
davila7/claude-code-templates
Senior FDA consultant and specialist for medical device companies including HIPAA compliance and requirement management.
Grc Knowledge
mlunato47/claude-grc-plugin
Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…
More from affaan-m/ECC
All 682 skills in this repoSkill Stocktake
affaan-m/ECC
Audits your installed Claude skills and commands for quality, with a quick mode for recently changed skills and a full mode that evaluates all of them through subagents.
VideoDB Video Search and Editing
affaan-m/ECC
Ingests, indexes, searches, edits and monitors video, audio and live streams through the VideoDB Python SDK, returning stream links, clips and timestamps.
Docs Governance
affaan-m/ECC
Route broad documentation-governance requests to existing ECC skills and run an opt-in, read-only audit of mapped documentation roles, links, ADR indexes, and evidence references.
Rules Distillation
affaan-m/ECC
Scans installed skills for principles that recur across them and proposes rule-file changes: append, revise, add a section, create a file or leave as covered.
Master Agreement Generator
affaan-m/ECC
Builds DRAFT counterparty agreements from one markdown template and a small JSON spec per party, with clauses picked by the party's role.
Frontend Design Direction
affaan-m/ECC
Set an ECC-specific frontend design direction for production UI work.
Related
Categories
Questions about Hipaa Compliance
What does Hipaa Compliance do?
HIPAA-specific entrypoint for healthcare privacy and security work. Hipaa Compliance is an agent skill from affaan-m/ECC. HIPAA-specific entrypoint for healthcare privacy and security work.
When should I use Hipaa Compliance?
Hipaa Compliance fits situations like: A task is explicitly framed around HIPAA; covered entities; US healthcare compliance requirements.
How do I install Hipaa Compliance in Claude Code?
Run `npx skills add affaan-m/ECC --skill hipaa-compliance -a claude-code`. Or copy the skill folder (skills/hipaa-compliance in affaan-m/ECC) into .claude/skills/hipaa-compliance in your project. Claude Code loads it when a task matches its description.
How do I install Hipaa Compliance in Codex?
Run `npx skills add affaan-m/ECC --skill hipaa-compliance -a codex`. Or copy the skill folder (skills/hipaa-compliance in affaan-m/ECC) into .agents/skills/hipaa-compliance in your project. Codex loads it when a task matches its description.
Can I use Hipaa Compliance in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add affaan-m/ECC --skill hipaa-compliance -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hipaa-compliance, .gemini/skills/hipaa-compliance, .github/skills/hipaa-compliance and .opencode/skills/hipaa-compliance in your project.
What does Hipaa Compliance need to run?
SKILL.md names no scripts, command-line tools or credentials: Hipaa Compliance is instructions for the agent only.
Does Hipaa Compliance access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Hipaa Compliance safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Hipaa Compliance use?
Hipaa Compliance is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Hipaa Compliance use?
About 908 tokens (SKILL.md is roughly 3.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Hipaa Compliance?
Skills that share tags, products or a category with Hipaa Compliance: HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), HIPAA Pre-Deployment Compliance Check (maziyarpanahi/openmed, 5.5k stars), Hipaa Compliance (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars) and ISO Standards Readiness Evidence (K-Dense-AI/scientific-agent-skills, 48k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Hipaa Compliance?
affaan-m (a GitHub user) maintains it in affaan-m/ECC, which has 276,673 GitHub stars. The repository holds 683 skills in this directory. The repository was last updated on October 11, 2026.
Source: affaan-m/ECC on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.