New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Hipaa Compliance

by curiositech in curiositech/some_claude_skills

Ensure HIPAA compliance when handling PHI (Protected Health Information).

MITAuto-check passedLegal & Compliance

Install Hipaa Compliance

skills CLI
$ npx skills add curiositech/some_claude_skills --skill hipaa-compliance -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install curiositech/some_claude_skills hipaa-compliance --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/curiositech/some_claude_skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/hipaa-compliance .claude/skills/hipaa-compliance && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
hipaa-compliance
GitHub stars
244
Used in
2 other repos
Token cost
~1.5k tokens
SKILL.md length
336 words
Files
2
Skills in repo
95
Repo updated
First seen
Licence
MIT

At a glance

Ensure HIPAA compliance when handling PHI (Protected Health Information).

  • Writing code that accesses user health data
  • SKILL.md covers What is PHI in This Application?, Audit Logging Requirements, Data Sanitization and Session Security Requirements, plus 5 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Journal entries

What it does

Hipaa Compliance is an agent skill from curiositech/some_claude_skills. Ensure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates for audit logging, data access, security events, and compliance questions.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `.claude-plugin/plugin.json`).

It sits in Legal & Compliance, covering Healthcare and finance regulation, Accounting and bookkeeping and Health and fitness tracking. The repository describes itself as: Claude skills that make my life easier. The licence is MIT.

When your agent uses it

  • Writing code that accesses user health data
  • Journal entries
  • Any sensitive information

Example prompts

  • “/hipaa-compliance”

Requirements

  • Pre-approved tools (allowed-tools): Read, Write, Edit

What it can do on your machine

Read from SKILL.md and the folder at commit 6713fc7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are typescript).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Hipaa Compliance loads about 1.5k tokens when it runs. Until then it costs about 72 tokens; SKILL.md has 336 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~72
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from curiositech/some_claude_skills at commit 6713fc7, republished under its MIT licence (© curiositech). 336 words, ~1,504 tokens.

Download SKILL.mdSave it as .claude/skills/hipaa-compliance/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
hipaa-compliance
description
Ensure HIPAA compliance when handling PHI (Protected Health Information). Use when writing code that accesses user health data, check-ins, journal entries, or any sensitive information. Activates for audit logging, data access, security events, and compliance questions.
allowed-tools
Read, Write, Edit
metadata.category
Code Quality & Testing
metadata.tags
hipaa, compliance, security

HIPAA Compliance for Recovery Coach

This skill helps you maintain HIPAA compliance when developing features that handle Protected Health Information (PHI).

What is PHI in This Application?

Data TypePHI StatusHandling
Check-in mood/cravingsPHIAudit all access
Journal entriesPHIAudit all access
Chat conversationsPHIAudit all access
User profile (name, email)PHIAudit modifications
Sobriety datePHIAudit access
Emergency contactsPHIAudit access
Usage analytics (aggregated)NOT PHINo audit needed
Page views (no content)NOT PHINo audit needed

Audit Logging Requirements

When to Log

Always log these operations:

  • Viewing any PHI (check-ins, journal, messages)
  • Creating/updating/deleting PHI
  • Exporting user data
  • Admin access to user information
  • Failed authentication attempts
  • Security events (rate limiting, unauthorized access)
How to Log

Use the audit logging utilities in src/lib/hipaa/audit.ts:

typescript
import {
  logPHIAccess,
  logPHIModification,
  logSecurityEvent,
  logAdminAction
} from '@/lib/hipaa/audit';

// Viewing PHI
await logPHIAccess(
  userId,
  'checkin',        // targetType
  checkinId,        // targetId
  AuditAction.PHI_VIEW
);

// Modifying PHI
await logPHIModification(
  userId,
  'journal',
  journalId,
  AuditAction.PHI_UPDATE,
  { field: 'content' }  // Never include actual content!
);

// Security event
await logSecurityEvent(
  userId,
  AuditAction.RATE_LIMIT,
  { path: '/api/chat', attempts: 60 }
);

// Admin action
await logAdminAction(
  adminId,
  AuditAction.ADMIN_USER_VIEW,
  'user',
  targetUserId
);

Data Sanitization

Never Log These Fields

The audit system automatically sanitizes, but be explicit:

typescript
// BAD - Contains PHI
await logPHIAccess(userId, 'journal', id, action, {
  content: journalEntry.content  // NEVER DO THIS
});

// GOOD - Only metadata
await logPHIAccess(userId, 'journal', id, action, {
  wordCount: journalEntry.content.length,
  hasAttachments: false
});
Sanitized Fields (Auto-Redacted)
  • password, token, secret, key
  • authorization, cookie, session
  • credential, content, message, notes

Session Security Requirements

From src/lib/auth.ts:

  • Session timeout: 15 minutes of inactivity (HIPAA requirement)
  • Max session: 8 hours absolute maximum
  • Failed login lockout: 5 attempts = 30 minute ban
  • Password requirements: 12+ chars, mixed case, numbers, special chars

Code Patterns

API Route with Audit Logging
typescript
import { getSession, requireAuth } from '@/lib/auth';
import { logPHIAccess } from '@/lib/hipaa/audit';

export async function GET(request: Request) {
  const session = await getSession();
  if (!session) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 });
  }

  // Fetch the data
  const data = await fetchUserData(session.userId);

  // Log the access
  await logPHIAccess(
    session.userId,
    'userdata',
    session.userId,
    AuditAction.PHI_VIEW
  );

  return Response.json(data);
}
Component with PHI Access
typescript
'use client';

import { useEffect } from 'react';

export function JournalViewer({ entryId }: { entryId: string }) {
  useEffect(() => {
    // Log view on mount (server-side preferred, but client backup)
    fetch('/api/audit/log', {
      method: 'POST',
      body: JSON.stringify({
        action: 'PHI_VIEW',
        targetType: 'journal',
        targetId: entryId
      })
    });
  }, [entryId]);

  // ... render
}

Compliance Checklist

Before shipping any feature that touches PHI:

  • All PHI access is audit logged
  • No PHI content in logs (only IDs and metadata)
  • Data access requires authentication
  • Admin access has separate audit trail
  • Failed access attempts are logged
  • Data export includes audit entry
  • Sensitive fields are encrypted at rest
  • Session timeout is enforced

Audit Log Retention

  • Minimum: 6 years (HIPAA requirement)
  • Format: Raw logs for 1 year, compressed thereafter
  • Location: audit_log table in database
  • Export: Encrypted exports for compliance audits

Emergency Access (Break Glass)

For emergency situations, use break-glass access:

typescript
import { requestBreakGlassAccess } from '@/lib/hipaa/break-glass';

// This creates enhanced audit trail
const access = await requestBreakGlassAccess(
  adminId,
  targetUserId,
  'Emergency support required - user reported crisis'
);

Break glass access:

  • Requires written justification
  • Creates permanent audit record
  • Triggers alert to compliance officer
  • Must be reviewed within 24 hours

Resources

  • HIPAA Security Rule: 45 C.F.R. § 164.312
  • Audit controls standard: 45 C.F.R. § 164.312(b)
  • Incident response plan: docs/INCIDENT-RESPONSE-PLAN.md
  • Security documentation: docs/SECURITY-HARDENING.md

© curiositech, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in .claude/skills/hipaa-compliance of curiositech/some_claude_skills.

  • SKILL.md
  • .claude-plugin/plugin.json

Open the folder on GitHubat commit 6713fc7

Used in 2 other repositories

We found 2 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in curiositech/some_claude_skills, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Hipaa Compliance next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Hipaa Compliance compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Hipaa Compliance this skillcuriositech/some_claude_skills2442 repos~1.5kAutomated safety check: PassMIT
Health Data Dpiamukul975/Privacy-Data-Protection-Skills301—~2.4kAutomated safety check: PassApache-2.0
Hipaa Interoperabilitymukul975/Privacy-Data-Protection-Skills301—~1.8kAutomated safety check: PassApache-2.0
Pia Health Datamukul975/Privacy-Data-Protection-Skills301—~2.3kAutomated safety check: PassApache-2.0
HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed5.5k—~1.7kAutomated safety check: PassApache-2.0
Patent Auditgfodor/legal-skills393—~2.9kAutomated safety check: PassGPL-3.0

Similar skills

  • Health Data Dpia

    mukul975/Privacy-Data-Protection-Skills

    Guides DPIA for health and medical data processing covering Art.

    301 GitHub stars~2.4k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • Hipaa Interoperability

    mukul975/Privacy-Data-Protection-Skills

    Addresses HIPAA privacy and security requirements for health data interoperability under the 21st Century Cures Act, ONC Health IT Certification Program, and CMS Interoperability and Patient Access…

    301 GitHub stars~1.8k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • Pia Health Data

    mukul975/Privacy-Data-Protection-Skills

    Conducts Privacy Impact Assessment for health data processing under GDPR Article 9, HIPAA, and sector-specific health privacy regulations.

    301 GitHub stars~2.3k tokensUpdated 6 mo ago
    Legal & ComplianceAuto-check passed

  • HIPAA Safe Harbor Coverage Audit

    maziyarpanahi/openmed

    Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.

    5.5k GitHub stars~1.7k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

  • Patent Audit

    gfodor/legal-skills

    Audit a draft U.S. An agent skill from gfodor/legal-skills.

    393 GitHub stars~2.9k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

  • HIPAA Pre-Deployment Compliance Check

    maziyarpanahi/openmed

    Walks a data pipeline against the HIPAA Privacy and Security Rule checklist and produces a gap report before it processes patient data.

    5.5k GitHub stars~2k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed

More from curiositech/some_claude_skills

All 95 skills in this repo

  • Crisis Detection Intervention AI

    curiositech/some_claude_skills

    Detect crisis signals in user content using NLP, mental health sentiment analysis, and safe intervention protocols.

    244 GitHub starsUsed in 2 repos~3.8k tokens
    Auto-check passed

  • Form Validation Architect

    curiositech/some_claude_skills

    End-to-end form handling with react-hook-form, Zod schemas, validation patterns, error messaging, field arrays, and multi-step wizards.

    244 GitHub stars~3.8k tokensUpdated 1 mo ago
    Auto-check passed

  • GitHub Actions Pipeline Builder

    curiositech/some_claude_skills

    Build production CI/CD pipelines with GitHub Actions. An agent skill from curiositech/some_claude_skills.

    244 GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check: notes

  • Background Job Orchestrator

    curiositech/some_claude_skills

    Expert in background job processing with Bull/BullMQ (Redis), Celery, and cloud queues.

    244 GitHub stars~3.2k tokensUpdated 1 mo ago
    Auto-check passed

  • Competitive Cartographer

    curiositech/some_claude_skills

    Strategic analyst that maps competitive landscapes, identifies white space opportunities, and provides positioning recommendations.

    244 GitHub stars~1.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Computer Vision Pipeline

    curiositech/some_claude_skills

    Build production computer vision pipelines for object detection, tracking, and video analysis.

    244 GitHub stars~4k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Hipaa Compliance

What does Hipaa Compliance do?

Ensure HIPAA compliance when handling PHI (Protected Health Information). Hipaa Compliance is an agent skill from curiositech/some_claude_skills. Ensure HIPAA compliance when handling PHI (Protected Health Information).

When should I use Hipaa Compliance?

Hipaa Compliance fits situations like: writing code that accesses user health data; journal entries; any sensitive information.

How do I install Hipaa Compliance in Claude Code?

Run `npx skills add curiositech/some_claude_skills --skill hipaa-compliance -a claude-code`. Or copy the skill folder (.claude/skills/hipaa-compliance in curiositech/some_claude_skills) into .claude/skills/hipaa-compliance in your project. Claude Code loads it when a task matches its description.

How do I install Hipaa Compliance in Codex?

Run `npx skills add curiositech/some_claude_skills --skill hipaa-compliance -a codex`. Or copy the skill folder (.claude/skills/hipaa-compliance in curiositech/some_claude_skills) into .agents/skills/hipaa-compliance in your project. Codex loads it when a task matches its description.

Can I use Hipaa Compliance in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add curiositech/some_claude_skills --skill hipaa-compliance -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hipaa-compliance, .gemini/skills/hipaa-compliance, .github/skills/hipaa-compliance and .opencode/skills/hipaa-compliance in your project.

What does Hipaa Compliance need to run?

SKILL.md names no scripts, command-line tools or credentials: Hipaa Compliance is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Write, Edit.

Does Hipaa Compliance access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Hipaa Compliance safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Hipaa Compliance use?

Hipaa Compliance is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Hipaa Compliance use?

About 1.5k tokens (SKILL.md is roughly 6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Hipaa Compliance?

Skills that share tags, products or a category with Hipaa Compliance: Health Data Dpia (mukul975/Privacy-Data-Protection-Skills, 301 stars), Hipaa Interoperability (mukul975/Privacy-Data-Protection-Skills, 301 stars), Pia Health Data (mukul975/Privacy-Data-Protection-Skills, 301 stars) and HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Hipaa Compliance?

curiositech (a GitHub organization) maintains it in curiositech/some_claude_skills, which has 244 GitHub stars. The repository holds 95 skills in this directory. The repository was last updated on September 6, 2026.

Source: curiositech/some_claude_skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.