HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
Implements HIPAA minimum necessary standard under 45 CFR §164.502(b).
Install Hipaa Minimum Necessary
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hipaa-minimum-necessary --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/hipaa-minimum-necessary .claude/skills/hipaa-minimum-necessary && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hipaa-minimum-necessary" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessary into .claude/skills/hipaa-minimum-necessary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-minimum-necessary", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessaryType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hipaa-minimum-necessary --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/hipaa-minimum-necessary .agents/skills/hipaa-minimum-necessary && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hipaa-minimum-necessary" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessary into .agents/skills/hipaa-minimum-necessary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-minimum-necessary", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hipaa-minimum-necessary --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/hipaa-minimum-necessary .cursor/skills/hipaa-minimum-necessary && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hipaa-minimum-necessary" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessary into .cursor/skills/hipaa-minimum-necessary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-minimum-necessary", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/hipaa-minimum-necessary--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hipaa-minimum-necessary --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/hipaa-minimum-necessary .gemini/skills/hipaa-minimum-necessary && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hipaa-minimum-necessary" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessary into .gemini/skills/hipaa-minimum-necessary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-minimum-necessary", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hipaa-minimum-necessaryInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/hipaa-minimum-necessary .github/skills/hipaa-minimum-necessary && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hipaa-minimum-necessary" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessary into .github/skills/hipaa-minimum-necessary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-minimum-necessary", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hipaa-minimum-necessary --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/hipaa-minimum-necessary .opencode/skills/hipaa-minimum-necessary && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hipaa-minimum-necessary" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hipaa-minimum-necessary into .opencode/skills/hipaa-minimum-necessary/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hipaa-minimum-necessary", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
hipaa-minimum-necessary- GitHub stars
- 297
- Token cost
- ~3.3k tokens
- SKILL.md length
- 1,535 words
- Files
- 5 (incl. scripts, references, assets)
- Skills in repo
- 280
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Implements HIPAA minimum necessary standard under 45 CFR §164.502(b).
- Works in 3 steps: Identify the workforce members or… → Identify the categories of PHI each… → Make reasonable efforts to limit access…
- Tasks that involve Healthcare and finance regulation
- SKILL.md covers Overview, Regulatory Framework, Implementation Requirements —… and HITECH Act §13405(b) —…, plus 4 more sections
- Runs Python scripts from its folder
What it does
Hipaa Minimum Necessary is an agent skill from mukul975/Privacy-Data-Protection-Skills. Implements HIPAA minimum necessary standard under 45 CFR §164.502(b). Covers role-based access policies per workforce member category, routine vs non-routine disclosure protocols, reasonable reliance doctrine, documentation requirements, and HITECH amendments. Keywords: minimum necessary, role-based access, workforce, routine disclosure, HIPAA.
Its SKILL.md is about 3.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Healthcare and finance regulation. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Healthcare and finance regulation
Example prompts
- “Use the hipaa-minimum-necessary skill to implement HIPAA minimum necessary standard under 45 CFR §164.502(b)”
- “/hipaa-minimum-necessary”
Requirements
- Python 3
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- Identify the workforce members or classes of workforce members who need access to PHI to carry out their duties
- Identify the categories of PHI each class of workforce members needs access to
- Make reasonable efforts to limit access to only the PHI identified as needed
What it can do on your machine
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Hipaa Minimum Necessary loads about 3.3k tokens when it runs, and up to ~4.4k if it reads all its reference files. Until then it costs about 93 tokens; SKILL.md has 1,535 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,535 words, ~3,257 tokens.
Download SKILL.mdSave it as
.claude/skills/hipaa-minimum-necessary/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- hipaa-minimum-necessary
- description
- Implements HIPAA minimum necessary standard under 45 CFR §164.502(b). Covers role-based access policies per workforce member category, routine vs non-routine disclosure protocols, reasonable reliance doctrine, documentation requirements, and HITECH amendments. Keywords: minimum necessary, role-based access, workforce, routine disclosure, HIPAA.
- license
- Apache-2.0
- metadata.author
- mukul975
- metadata.version
- 1.0
- metadata.domain
- privacy
- metadata.subdomain
- healthcare-privacy
- metadata.tags
- hipaa, minimum-necessary, role-based-access, workforce, routine-disclosure, phi-limitation
HIPAA Minimum Necessary Standard — 45 CFR §164.502(b)
Overview
The minimum necessary standard is a core principle of the HIPAA Privacy Rule requiring covered entities to make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. Codified at 45 CFR §164.502(b) and elaborated in §164.514(d), this standard affects every PHI handling decision within a covered entity's operations. The HITECH Act §13405(b) directed HHS to issue guidance on defining "minimum necessary" with greater specificity, and while HHS has not issued a final rule on this provision, OCR has consistently enforced the standard through settlements and corrective action plans.
Regulatory Framework
Statutory and Regulatory Basis
- 45 CFR §164.502(b)(1): "When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request."
- 45 CFR §164.514(d): Implementation specifications for the minimum necessary standard
- HITECH Act §13405(b): Required HHS to issue guidance defining minimum necessary; pending final rule, the standard is applied as a reasonableness standard
Exceptions to Minimum Necessary — §164.502(b)(2)
The minimum necessary standard does NOT apply to:
| Exception | Rationale |
|---|---|
| Disclosures to or requests by a healthcare provider for treatment | Treatment requires full clinical picture; limiting information could compromise patient safety |
| Uses or disclosures to the individual who is the subject of the PHI | Individuals have a right to their complete information |
| Uses or disclosures pursuant to a valid authorization under §164.508 | The individual has specifically authorized the scope of disclosure |
| Disclosures to HHS for compliance investigation/enforcement | HHS needs access to determine compliance |
| Uses or disclosures required by law | Legal mandate supersedes minimum necessary limitation |
| Uses or disclosures required for HIPAA Administrative Simplification compliance | Standard transactions require specified data elements |
Implementation Requirements — §164.514(d)
Uses of PHI by Workforce — §164.514(d)(2)
For internal uses of PHI, the covered entity must:
- Identify the workforce members or classes of workforce members who need access to PHI to carry out their duties
- Identify the categories of PHI each class of workforce members needs access to
- Make reasonable efforts to limit access to only the PHI identified as needed
Asclepius Health Network Role-Based Access Matrix:
| Workforce Role | PHI Access Categories | Access Scope | EHR Access Level |
|---|---|---|---|
| Attending Physician | Full clinical record of assigned patients | Current and historical encounters | Full read/write on assigned patients; read-only on others via break-the-glass |
| Consulting Specialist | Clinical record relevant to consultation | Current encounter, relevant history | Read-only on referred patients for relevant clinical domains |
| Registered Nurse (Inpatient) | Nursing assessments, vital signs, medication administration, care plans, physician orders | Current admission on assigned unit | Read/write for assigned patients on unit; read-only for transferred patients for continuity |
| Emergency Department Nurse | Full clinical record of ED patients | Current ED encounter | Full read/write for ED patients; access terminates at discharge/transfer |
| Pharmacist | Medication orders, allergies, diagnoses relevant to drug therapy, renal/hepatic function | Current and recent encounters | Read medication-related clinical data; write medication verification/dispensing |
| Medical Coder | Diagnoses, procedures, operative notes, discharge summaries | Post-discharge records | Read-only for coding-relevant documentation |
| Billing Specialist | Demographics, insurance information, diagnosis codes, procedure codes, dates of service | Billed encounters | No access to clinical notes; demographics and billing codes only |
| Registration Clerk | Demographics, insurance information, emergency contacts | Registration screen only | Read/write limited to demographic and insurance fields |
| Quality Improvement Analyst | Aggregate clinical data, de-identified data, limited datasets per DUA | Population-level reports | Limited dataset access with data use agreement; no individual record access without specific justification |
| IT Support Staff | System administration — may access ePHI incidentally during troubleshooting | As needed for technical support | Logged access during active support ticket; no browsing; all access audited |
| Executive Leadership | Summary reports, aggregate statistics | De-identified or aggregate | Dashboard access only; no individual patient record access |
| Legal Counsel | PHI related to active litigation or compliance investigation | Specific records per legal hold | Access granted per matter with Privacy Office authorization |
Routine and Recurring Disclosures — §164.514(d)(3)(i)
For routine, recurring disclosures, the covered entity must implement policies and procedures that limit the PHI disclosed to the amount reasonably necessary to achieve the purpose:
Asclepius Health Network Routine Disclosure Protocols:
| Routine Disclosure Type | Standard PHI Set | Excluded PHI |
|---|---|---|
| Insurance eligibility verification | Patient name, DOB, insurance ID, service date | Clinical information, diagnoses, SSN |
| Referral to external provider | Relevant clinical summary, current medications, allergies, reason for referral | Unrelated historical diagnoses, substance abuse records (42 CFR Part 2), psychotherapy notes |
| Workers' compensation claim | Work-related injury/illness records, treatment for that condition | Unrelated medical history |
| Pre-authorization request | Proposed procedure, clinical justification, relevant diagnostic results | Complete medical record |
| Public health reporting | Required data elements per reporting jurisdiction statute | Additional clinical detail beyond reportable elements |
| Subpoena response (with qualified protective order) | Records specified in the subpoena/court order | Records beyond the scope of the order |
Non-Routine Disclosures — §164.514(d)(3)(ii)
For non-routine disclosures, the covered entity must:
- Develop criteria to limit PHI to the minimum necessary for the particular disclosure
- Review each request on a case-by-case basis against the criteria
Asclepius Health Network Non-Routine Disclosure Process:
- All non-routine PHI requests are routed to the Health Information Management (HIM) department
- HIM specialist reviews the request against the purpose stated
- If the purpose is unclear or the request scope appears broader than necessary, HIM contacts the requestor for clarification
- Privacy Officer review is required for requests involving: psychotherapy notes, substance abuse records, HIV/STI records, records of minors, requests from law enforcement without a warrant, and any request affecting more than 50 individuals
- Only the PHI elements necessary for the stated purpose are disclosed
- The disclosure is logged with the scope justification for accounting of disclosures
Show full SKILL.md (586 more words)Show less
Disclosures to Other Covered Entities — Reasonable Reliance §164.514(d)(3)(iii)
A covered entity may rely on a request from another covered entity or business associate as meeting minimum necessary if:
| Requestor Type | Reasonable Reliance Permitted When |
|---|---|
| Public official | Request states PHI is the minimum necessary for the stated purpose (§164.514(d)(3)(iii)(A)) |
| Another covered entity | Request is for PHI the requestor needs (§164.514(d)(3)(iii)(B)) |
| Professional member of the workforce of the CE or BA | Represents that PHI requested is the minimum necessary for the stated purpose (§164.514(d)(3)(iii)(C)) |
| Research with IRB/Privacy Board waiver | Waiver documentation represents PHI is the minimum necessary for the research (§164.514(d)(3)(iii)(D)) |
Reasonable reliance does not eliminate the disclosing entity's obligation; it shifts the burden of determining minimum necessary to the requestor in specified circumstances.
HITECH Act §13405(b) — Enhanced Minimum Necessary
HITECH §13405(b) added two provisions:
- Limited dataset standard: Until HHS issues final guidance, if a covered entity is required to comply with the minimum necessary standard and determines that a limited dataset (§164.514(e)) would accomplish the purpose, the minimum necessary standard is met by providing the limited dataset
- Future guidance: HHS was directed to issue regulations that further restrict minimum necessary to limit information to the minimum necessary for the stated purpose — this final rule remains pending
Documentation Requirements
Covered entities must document and maintain:
- Policies and procedures implementing the minimum necessary standard (§164.530(i))
- Role-based access definitions identifying PHI categories by workforce class (§164.514(d)(2))
- Routine disclosure protocols specifying standard PHI sets (§164.514(d)(3)(i))
- Non-routine review criteria and case-by-case determination records (§164.514(d)(3)(ii))
- Training materials covering minimum necessary for all workforce members
- Sanction records for workforce members who violate minimum necessary policies
All documentation must be retained for 6 years from creation or last effective date under §164.530(j).
Common Minimum Necessary Violations
| Violation Pattern | Example | Remediation |
|---|---|---|
| Granting full record access by default | All nurses have access to all patient records across all departments | Implement unit-based access restrictions; require break-the-glass for cross-department access |
| Sending entire medical record in response to limited request | Attorney requests records related to knee surgery; HIM sends complete chart | Train HIM on request scope analysis; implement disclosure review checklist |
| Overly broad role definitions | "Clinician" role grants same access to physicians, nurses, medical assistants, and technicians | Granular role definitions aligned with job function; separate access profiles per clinical role |
| No logging of access for minimum necessary auditing | Unable to determine if workforce members are accessing only patients in their care | Implement access audit reports comparing records accessed to assigned patients |
| Faxing full face sheets with all demographics for limited purpose | Registration faxes complete demographic page to pharmacy for prescription verification | Create limited forms with only necessary fields per transaction type |
Enforcement Actions
- Memorial Hermann Health System (2017): $2.4 million — disclosed a patient's PHI (name linked to involvement in a vehicular incident) in a press release, exceeding minimum necessary
- Cignet Health (2011): $4.3 million (CMP) — although primarily for denial of access rights, OCR noted systemic failure to implement minimum necessary policies
- CVS Pharmacy (2009): $2.25 million — improper disposal of PHI in dumpsters reflected failure to implement minimum necessary in disposal processes
Integration Points
- hipaa-privacy-rule: Minimum necessary is a core Privacy Rule requirement affecting all uses and disclosures
- hipaa-security-rule: Technical access controls (§164.312(a)) implement minimum necessary through role-based ePHI access
- hipaa-baa-management: BAAs must limit BA access to minimum necessary PHI for contracted services
- hipaa-deidentification: De-identification and limited datasets serve as minimum necessary tools for research and analytics
- 42-cfr-part-2: Substance abuse records have their own consent-based minimum necessary requirements that are stricter than HIPAA
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/hipaa-minimum-necessary of mukul975/Privacy-Data-Protection-Skills.
- SKILL.md
- assets/template.md
- references/standards.md
- references/workflows.md
- scripts/process.py
Open the folder on GitHubat commit 9b2ef9e
Compare with similar skills
Hipaa Minimum Necessary next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hipaa Minimum Necessary this skillmukul975/Privacy-Data-Protection-Skills | 297 | — | ~3.3k | Automated safety check: Pass | Apache-2.0 | |
| HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed | 5.5k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| HIPAA Pre-Deployment Compliance Checkmaziyarpanahi/openmed | 5.5k | — | ~2k | Automated safety check: Pass | Apache-2.0 | |
| Hipaa ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 943 | 1 repos | ~2.3k | Automated safety check: Pass | MIT | |
| ISO Standards Readiness EvidenceK-Dense-AI/scientific-agent-skills | 48k | 1 repos | ~4.6k | Automated safety check: Notes | MIT | |
| Fda Consultant Specialistdavila7/claude-code-templates | 32k | 1 repos | ~2.7k | Automated safety check: Pass | MIT |
Similar skills
HIPAA Pre-Deployment Compliance Check
maziyarpanahi/openmed
Walks a data pipeline against the HIPAA Privacy and Security Rule checklist and produces a gap report before it processes patient data.
Hipaa Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert HIPAA compliance assistant for healthcare and software contexts.
ISO Standards Readiness Evidence
K-Dense-AI/scientific-agent-skills
Organizes scope, controlled documents, risk files and traceability into draft evidence for human review against ISO 13485, 14971, 17025 and 15189.
Fda Consultant Specialist
davila7/claude-code-templates
Senior FDA consultant and specialist for medical device companies including HIPAA compliance and requirement management.
Grc Knowledge
mlunato47/claude-grc-plugin
Senior GRC analyst expertise across 18 compliance frameworks — NIST 800-53, FedRAMP (Rev5 + 20x/CR26, KSIs, VDR/VER, Certification Classes A–D), DoD/DoW Impact Levels (IL2–IL6, DISA Cloud SRG), ITAR…
More from mukul975/Privacy-Data-Protection-Skills
All 280 skills in this repoAge Gating Services
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
AI Data Retention
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
AI Dpia
mukul975/Privacy-Data-Protection-Skills
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.
Dpia Mitigation Plan
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
Gdpr Accountability
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
Pia Threshold Screening
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
Related
Categories
Questions about Hipaa Minimum Necessary
What does Hipaa Minimum Necessary do?
Implements HIPAA minimum necessary standard under 45 CFR §164.502(b). Hipaa Minimum Necessary is an agent skill from mukul975/Privacy-Data-Protection-Skills.502(b).
When should I use Hipaa Minimum Necessary?
Hipaa Minimum Necessary fits situations like: tasks that involve Healthcare and finance regulation.
How do I install Hipaa Minimum Necessary in Claude Code?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a claude-code`. Or copy the skill folder (skills/privacy/hipaa-minimum-necessary in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/hipaa-minimum-necessary in your project. Claude Code loads it when a task matches its description.
How do I install Hipaa Minimum Necessary in Codex?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a codex`. Or copy the skill folder (skills/privacy/hipaa-minimum-necessary in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/hipaa-minimum-necessary in your project. Codex loads it when a task matches its description.
Can I use Hipaa Minimum Necessary in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill hipaa-minimum-necessary -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hipaa-minimum-necessary, .gemini/skills/hipaa-minimum-necessary, .github/skills/hipaa-minimum-necessary and .opencode/skills/hipaa-minimum-necessary in your project.
What does Hipaa Minimum Necessary need to run?
Going by SKILL.md and its folder, Hipaa Minimum Necessary needs Python for the scripts in its folder. Our summary lists: Python 3.
Does Hipaa Minimum Necessary access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Hipaa Minimum Necessary safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Hipaa Minimum Necessary use?
Hipaa Minimum Necessary is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Hipaa Minimum Necessary use?
About 3.3k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.2k tokens, read only when the agent opens those files.
What are the alternatives to Hipaa Minimum Necessary?
Skills that share tags, products or a category with Hipaa Minimum Necessary: HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), HIPAA Pre-Deployment Compliance Check (maziyarpanahi/openmed, 5.5k stars), Hipaa Compliance (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 943 stars) and ISO Standards Readiness Evidence (K-Dense-AI/scientific-agent-skills, 48k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Hipaa Minimum Necessary?
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 297 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.