HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
Implements HITECH Act privacy and security requirements including breach notification expansion, four-tier penalty structure, state attorney general enforcement authority, EHR meaningful use privacy…
Install Hitech Act Privacy
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hitech-act-privacy --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/hitech-act-privacy .claude/skills/hitech-act-privacy && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "hitech-act-privacy" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacy into .claude/skills/hitech-act-privacy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hitech-act-privacy", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacyType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hitech-act-privacy --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/hitech-act-privacy .agents/skills/hitech-act-privacy && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "hitech-act-privacy" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacy into .agents/skills/hitech-act-privacy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hitech-act-privacy", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hitech-act-privacy --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/hitech-act-privacy .cursor/skills/hitech-act-privacy && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "hitech-act-privacy" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacy into .cursor/skills/hitech-act-privacy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hitech-act-privacy", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/hitech-act-privacy--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hitech-act-privacy --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/hitech-act-privacy .gemini/skills/hitech-act-privacy && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "hitech-act-privacy" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacy into .gemini/skills/hitech-act-privacy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hitech-act-privacy", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hitech-act-privacyInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/hitech-act-privacy .github/skills/hitech-act-privacy && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "hitech-act-privacy" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacy into .github/skills/hitech-act-privacy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hitech-act-privacy", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills hitech-act-privacy --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/hitech-act-privacy .opencode/skills/hitech-act-privacy && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "hitech-act-privacy" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/hitech-act-privacy into .opencode/skills/hitech-act-privacy/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "hitech-act-privacy", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
hitech-act-privacy- GitHub stars
- 301
- Token cost
- ~3.3k tokens
- SKILL.md length
- 1,551 words
- Files
- 5 (incl. scripts, references, assets)
- Skills in repo
- 280
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Implements HITECH Act privacy and security requirements including breach notification expansion, four-tier penalty structure, state attorney general enforcement authority, EHR meaningful use privacy…
- Tasks that involve Healthcare and finance regulation
- SKILL.md covers Overview, Breach Notification — HITECH…, Penalty Structure — HITECH… and State Attorney General…, plus 7 more sections
- Runs Python scripts from its folder
- Tasks that involve Clinical and healthcare research
What it does
Hitech Act Privacy is an agent skill from mukul975/Privacy-Data-Protection-Skills. Implements HITECH Act privacy and security requirements including breach notification expansion, four-tier penalty structure, state attorney general enforcement authority, EHR meaningful use privacy conditions, and business associate direct liability. Keywords: HITECH Act, breach notification, penalty tiers, state AG enforcement, meaningful use, EHR privacy.
Its SKILL.md is about 3.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Healthcare and finance regulation, Clinical and healthcare research and Privacy and GDPR. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Healthcare and finance regulation
- Tasks that involve Clinical and healthcare research
- Tasks that involve Privacy and GDPR
Example prompts
- “Use the hitech-act-privacy skill to implement HITECH Act privacy and security requirements including breach notification expansion, four-tier…”
- “/hitech-act-privacy”
Requirements
- Python 3
What it can do on your machine
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Hitech Act Privacy loads about 3.3k tokens when it runs, and up to ~4.9k if it reads all its reference files. Until then it costs about 95 tokens; SKILL.md has 1,551 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 1,551 words, ~3,268 tokens.
Download SKILL.mdSave it as
.claude/skills/hitech-act-privacy/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- hitech-act-privacy
- description
- Implements HITECH Act privacy and security requirements including breach notification expansion, four-tier penalty structure, state attorney general enforcement authority, EHR meaningful use privacy conditions, and business associate direct liability. Keywords: HITECH Act, breach notification, penalty tiers, state AG enforcement, meaningful use, EHR privacy.
- license
- Apache-2.0
- metadata.author
- mukul975
- metadata.version
- 1.0
- metadata.domain
- privacy
- metadata.subdomain
- healthcare-privacy
- metadata.tags
- hitech-act, breach-notification, penalty-tiers, state-ag-enforcement, meaningful-use, ehr-privacy
HITECH Act Privacy and Security Requirements
Overview
The Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted as Title XIII of the American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5). HITECH fundamentally transformed HIPAA enforcement by establishing breach notification requirements, creating a four-tier penalty structure with significantly increased penalties, granting enforcement authority to state attorneys general, extending HIPAA Security Rule requirements directly to business associates, and tying privacy and security compliance to the Electronic Health Record (EHR) meaningful use incentive program. The 2013 Omnibus Rule (78 FR 5566) implemented most HITECH provisions into the HIPAA regulatory framework.
Breach Notification — HITECH §13402
Establishment of Federal Healthcare Breach Notification
Prior to HITECH, HIPAA had no breach notification requirement. HITECH §13402 created the obligation for covered entities and business associates to notify individuals, HHS, and in some cases the media, following a breach of unsecured PHI.
Key provisions enacted by HITECH:
| Provision | HITECH Section | Implementation |
|---|---|---|
| Individual notification within 60 days | §13402(a) | Codified at 45 CFR §164.404 |
| HHS notification for breaches of 500+ immediately; under 500 annually | §13402(e)(1)-(3) | Codified at 45 CFR §164.408 |
| Media notification for 500+ in a state/jurisdiction | §13402(e)(2) | Codified at 45 CFR §164.406 |
| State AG notification for 500+ in a state | §13402(e)(3) | 45 CFR §164.408(c) |
| BA obligation to notify CE | §13402(b) | Codified at 45 CFR §164.410 |
| Unsecured PHI definition and safe harbor for encryption/destruction | §13402(h) | HHS guidance at 74 FR 19006 |
Evolution of the Breach Standard
HITECH originally used a "harm standard" — notification was required only if there was a significant risk of financial, reputational, or other harm. The 2013 Omnibus Rule replaced this with the "low probability of compromise" standard under the four-factor risk assessment (§164.402(2)), which is more protective of individuals. Under this standard, an impermissible use or disclosure is presumed to be a breach unless the entity demonstrates low probability of compromise.
Penalty Structure — HITECH §13410
Four-Tier Civil Monetary Penalty Framework
HITECH §13410(d) replaced the single-tier HIPAA penalty structure with a graduated system based on culpability:
| Tier | Culpability Level | Per Violation (2024 adjusted) | Annual Cap (2024 adjusted) | Correction Possible |
|---|---|---|---|---|
| A | Did not know and would not have known by exercising reasonable diligence | $137 – $68,928 | $2,067,813 | Must correct within 30 days |
| B | Reasonable cause (not willful neglect) | $1,379 – $68,928 | $2,067,813 | Must correct within 30 days |
| C | Willful neglect — timely corrected | $13,785 – $68,928 | $2,067,813 | Corrected within 30 days of knowledge |
| D | Willful neglect — not timely corrected | $68,928 – $2,067,813 | $2,067,813 | Investigation/penalty mandatory |
Penalty amounts are adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015.
Criminal Penalties
HITECH preserved and enhanced criminal penalties under 42 USC §1320d-6:
| Tier | Conduct | Maximum Penalty |
|---|---|---|
| 1 | Knowingly obtaining or disclosing PHI | Up to $50,000 fine and 1 year imprisonment |
| 2 | Offenses committed under false pretenses | Up to $100,000 fine and 5 years imprisonment |
| 3 | Offenses with intent to sell, transfer, or use for commercial advantage, personal gain, or malicious harm | Up to $250,000 fine and 10 years imprisonment |
Percentage of CMPs and Settlements to Affected Individuals — §13410(c)(2)
HITECH §13410(c)(2) directed HHS to establish methods for distributing a percentage of CMPs and settlement amounts to individuals harmed by HIPAA violations. HHS has not yet issued final regulations implementing this provision, but OCR has included equitable relief provisions in certain settlement agreements.
State Attorney General Enforcement — HITECH §13410(e)
Authority Granted
HITECH §13410(e) authorized state attorneys general to bring civil actions in federal district court on behalf of state residents who may have been affected by HIPAA violations. This was a significant expansion — previously only HHS/OCR could enforce HIPAA.
Requirements for State AG Actions
| Requirement | Detail |
|---|---|
| Prior notice to HHS | State AG must provide notice to the Secretary of HHS before filing suit |
| HHS intervention right | HHS may intervene and assume primary responsibility for the action |
| No action during pending HHS action | State AG may not bring action during a pending HHS action against the same entity for the same violation |
| Remedies available | Injunctive relief, damages (up to $100 per violation, $25,000 per calendar year per identical violation), attorneys' fees |
State AG Enforcement Precedents
| State | Year | Entity | Outcome |
|---|---|---|---|
| Connecticut | 2010 | Health Net of Connecticut | $250,000 settlement — first state AG action under HITECH; loss of unencrypted hard drive with PHI of 1.5 million individuals |
| Minnesota | 2011 | Accretive Health | $2.5 million settlement — unauthorized access to PHI; failure to have BAA |
| Indiana | 2014 | WellPoint (Anthem) | $1.9 million penalty — application vulnerability exposing ePHI of 612,402 individuals; state AG used HITECH authority alongside state law |
| New York | 2021 | EyeMed Vision Care | $600,000 settlement — email phishing breach exposing PHI of 2.1 million; state AG cited HITECH and state consumer protection |
| New Jersey | 2019 | Virtua Medical Group | $418,000 settlement — disclosure of PHI to vendor without BAA |
Business Associate Direct Liability — HITECH §13401
Pre-HITECH vs Post-HITECH
| Aspect | Pre-HITECH | Post-HITECH (§13401) |
|---|---|---|
| Security Rule compliance | Contractual obligation through BAA only; no direct regulatory liability | BAs directly subject to Security Rule; enforceable by OCR and state AGs |
| Privacy Rule | BAs bound only by BAA terms | BAs directly liable for impermissible uses/disclosures; subject to minimum necessary |
| Penalties | Only covered entities subject to HIPAA penalties; BAs subject only to breach of contract | BAs subject to same civil and criminal penalties as covered entities |
| Subcontractors | No regulatory requirements | Subcontractors treated as BAs; must have BAAs in place |
Impact on Asclepius Health Network
Asclepius Health Network manages 47 business associate relationships. Post-HITECH, each BA must:
- Independently comply with all Security Rule administrative, physical, and technical safeguards
- Report breaches to Asclepius within 5 business days per the BAA
- Demonstrate compliance through annual security assessments
- Flow down BAA requirements to their subcontractors
Show full SKILL.md (623 more words)Show less
EHR Meaningful Use Privacy Conditions — HITECH §13401(b)
Privacy and Security as Prerequisites for Incentive Payments
HITECH created the Medicare and Medicaid EHR Incentive Programs (now known as Promoting Interoperability) with total payments exceeding $38 billion. Privacy and security compliance is a prerequisite for receiving incentive payments:
| Meaningful Use Stage | Privacy/Security Requirements |
|---|---|
| Stage 1 (2011-2013) | Conduct or review a security risk analysis; implement security updates; correct identified security deficiencies |
| Stage 2 (2014-2016) | All Stage 1 requirements plus: address encryption/security of data at rest; enable patient electronic access to health information |
| Stage 3 / Promoting Interoperability (2017+) | Security risk analysis; patient electronic access; secure messaging; API access; ONC Health IT Certification privacy and security criteria |
Privacy Requirements in Health IT Certification
ONC Health IT Certification Criteria (45 CFR Part 170) require certified EHR technology to support:
- Authentication, access control, and authorization
- Auditable events and tamper-resistance
- Automatic access time-out
- Emergency access
- End-user device encryption
- Integrity verification
- Accounting of disclosures
- Amendments to health information
- Consent management (including segmentation for Part 2 and state-specific restrictions)
Asclepius Health Network uses ONC-certified Epic EHR and verifies that each software version maintains certification for privacy and security criteria. The Promoting Interoperability dashboard tracks privacy measure compliance for CMS attestation.
Accounting of Disclosures Expansion — HITECH §13405(c)
HITECH Expansion
HITECH §13405(c) expanded the right to an accounting of disclosures to include disclosures through an electronic health record for treatment, payment, and healthcare operations (previously excluded under HIPAA §164.528). The accounting period was set at 3 years (rather than HIPAA's 6 years) for EHR disclosures.
Status: HHS published a Notice of Proposed Rulemaking in 2011 (76 FR 31426) proposing an "access report" approach but withdrew the NPRM and has not issued a final rule. The HITECH provision is self-executing in the statute but implementation guidance remains pending.
Restrictions on Sale of PHI — HITECH §13405(d)
HITECH §13405(d) prohibits a covered entity or business associate from receiving direct or indirect remuneration in exchange for PHI without a valid authorization from the individual that states whether the PHI can be further exchanged for remuneration.
Exceptions
| Exception | Description |
|---|---|
| Public health | Disclosures for public health activities under §164.512(b) |
| Research | Reasonable cost-based fee for preparing and transmitting PHI for research |
| Treatment and payment | Normal treatment and payment activities |
| Transfer of business | Sale, transfer, merger of covered entity |
| BA services | Remuneration is for services BA provides on behalf of CE |
| Individual request | Individual requests own PHI |
| HHS-determined exceptions | Other purposes determined by HHS through regulation |
Minimum Necessary Enhancement — HITECH §13405(b)
HITECH directed HHS to issue guidance making the minimum necessary standard more specific:
- Until HHS issues guidance, the limited dataset standard (§164.514(e)) is the floor for minimum necessary when PHI is in electronic form and a limited dataset would accomplish the purpose
- HHS has not issued the final rule, but the provision is self-executing to the extent described
Enforcement Milestones Under HITECH
| Year | Action | Significance |
|---|---|---|
| 2009 | HITECH enacted | Four-tier penalties, breach notification, BA liability, state AG enforcement |
| 2010 | Interim Final Breach Notification Rule | Initial implementation of breach notification with harm standard |
| 2011 | First resolution agreement post-HITECH (Cignet Health, $4.3M) | Demonstrated willingness to impose significant penalties |
| 2013 | Omnibus Rule | Comprehensive implementation of HITECH provisions into HIPAA regulations |
| 2016 | Advocate Medical Group ($5.55M) | Largest fine at the time; multiple breaches involving unencrypted devices |
| 2018 | Anthem ($16M) | Largest HIPAA settlement; demonstrated HITECH penalty levels for major breaches |
| 2020-2024 | Annual penalty adjustments | Inflation-adjusted penalties increasing annually |
Integration Points
- hipaa-breach-notify: HITECH created the breach notification framework implemented in the Breach Notification Rule
- hipaa-privacy-rule: HITECH strengthened Privacy Rule provisions including restrictions on sale of PHI and minimum necessary
- hipaa-security-rule: HITECH extended Security Rule directly to business associates
- hipaa-baa-management: HITECH created BA direct liability and subcontractor requirements
- hipaa-risk-analysis: Risk analysis is a prerequisite for EHR meaningful use/Promoting Interoperability attestation
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/hitech-act-privacy of mukul975/Privacy-Data-Protection-Skills.
- SKILL.md
- assets/template.md
- references/standards.md
- references/workflows.md
- scripts/process.py
Open the folder on GitHubat commit 9b2ef9e
Compare with similar skills
Hitech Act Privacy next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Hitech Act Privacy this skillmukul975/Privacy-Data-Protection-Skills | 301 | — | ~3.3k | Automated safety check: Pass | Apache-2.0 | |
| HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed | 5.5k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Hipaa ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance | 946 | 1 repos | ~2.3k | Automated safety check: Pass | MIT | |
| Clinical Reportsdavila7/claude-code-templates | 33k | 11 repos | ~9.9k | Automated safety check: Notes | MIT | |
| Audit Reportharness/harness-skills | 115 | — | ~1.3k | Automated safety check: Pass | Apache-2.0 | |
| Anne WojcickiK-Dense-AI/mimeographs | 129 | — | ~1.5k | Automated safety check: Pass | MIT |
Similar skills
Hipaa Compliance
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
Expert HIPAA compliance assistant for healthcare and software contexts.
Clinical Reports
davila7/claude-code-templates
Write comprehensive clinical reports including case reports (CARE guidelines), diagnostic reports (radiology/pathology/lab), clinical trial reports (ICH-E3, SAE, CSR), and patient documentation…
Audit Report
harness/harness-skills
Generate audit reports and compliance trails using Harness audit trail data via MCP v2 tools.
Anne Wojcicki
K-Dense-AI/mimeographs
Applies the strategic frameworks and mental models of Anne Wojcicki, co-founder and CEO of 23andMe.
Dpa Checklist Review
LegalQuants/lq-ai
A skill your agent uses when the user provides a Data Processing Agreement, Data Processing Addendum, or HIPAA Business Associate Agreement and asks whether it contains the terms required under the…
More from mukul975/Privacy-Data-Protection-Skills
All 280 skills in this repoAge Gating Services
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
AI Data Retention
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
AI Dpia
mukul975/Privacy-Data-Protection-Skills
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.
Dpia Mitigation Plan
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
Gdpr Accountability
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
Pia Threshold Screening
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
Related
Categories
Questions about Hitech Act Privacy
What does Hitech Act Privacy do?
Implements HITECH Act privacy and security requirements including breach notification expansion, four-tier penalty structure, state attorney general enforcement authority, EHR meaningful use privacy…. Hitech Act Privacy is an agent skill from mukul975/Privacy-Data-Protection-Skills. Implements HITECH Act privacy and security requirements including breach notification expansion, four-tier penalty structure, state attorney general enforcement authority, EHR meaningful use privacy conditions, and business associate direct liability.
When should I use Hitech Act Privacy?
Hitech Act Privacy fits situations like: tasks that involve Healthcare and finance regulation; tasks that involve Clinical and healthcare research; tasks that involve Privacy and GDPR.
How do I install Hitech Act Privacy in Claude Code?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a claude-code`. Or copy the skill folder (skills/privacy/hitech-act-privacy in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/hitech-act-privacy in your project. Claude Code loads it when a task matches its description.
How do I install Hitech Act Privacy in Codex?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a codex`. Or copy the skill folder (skills/privacy/hitech-act-privacy in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/hitech-act-privacy in your project. Codex loads it when a task matches its description.
Can I use Hitech Act Privacy in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill hitech-act-privacy -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/hitech-act-privacy, .gemini/skills/hitech-act-privacy, .github/skills/hitech-act-privacy and .opencode/skills/hitech-act-privacy in your project.
What does Hitech Act Privacy need to run?
Going by SKILL.md and its folder, Hitech Act Privacy needs Python for the scripts in its folder. Our summary lists: Python 3.
Does Hitech Act Privacy access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Hitech Act Privacy safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Hitech Act Privacy use?
Hitech Act Privacy is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Hitech Act Privacy use?
About 3.3k tokens (SKILL.md is roughly 13k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.6k tokens, read only when the agent opens those files.
What are the alternatives to Hitech Act Privacy?
Skills that share tags, products or a category with Hitech Act Privacy: HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), Hipaa Compliance (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), Clinical Reports (davila7/claude-code-templates, 33k stars) and Audit Report (harness/harness-skills, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Hitech Act Privacy?
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 301 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.