Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:
healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.
healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.
security-review still applies for general auth, input-handling, secrets, API, and deployment hardening.
When to Use
The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter
How It Works
Treat HIPAA as an overlay on top of the broader healthcare privacy skill:
Start with healthcare-phi-compliance for the concrete implementation rules.
Apply HIPAA-specific decision gates:
Is this data PHI?
Is this actor a covered entity or business associate?
Does a vendor or model provider require a BAA before touching the data?
Is access limited to the minimum necessary scope?
Are read/write/export events auditable?
Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture.
HIPAA-Specific Guardrails
Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.
Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.
Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.
Examples
Example 1: Product request framed as HIPAA
User request:
Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.
Response pattern:
Activate hipaa-compliance
Use healthcare-phi-compliance to review PHI movement, logging, storage, and prompt boundaries
Verify whether the summarization provider is covered by a BAA before any PHI is sent
Escalate to healthcare-reviewer if the summaries influence clinical decisions
Example 2: Vendor/tooling decision
User request:
Can we send support transcripts and patient messages into our analytics stack?
Response pattern:
Assume those messages may contain PHI
Block the design unless the analytics vendor is approved for HIPAA-bound workloads and the data path is minimized
Require redaction or a non-PHI event model when possible
docker-patternsaffaan-mDocker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when setting up containerized development environments or reviewing Docker configurations.4,8004,800 instalaciones en skills.sh0
security-reviewaffaan-mUse this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.4,8004,800 instalaciones en skills.sh0
backend-patternsaffaan-mBackend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes. Use when building or reviewing Node.js, Express, or Next.js API routes and their data access.4,7004,700 instalaciones en skills.sh0
frontend-patternsaffaan-mFrontend development patterns for React, Next.js, state management, performance optimization, and UI best practices. Use when building or reviewing React or Next.js components, state, or render performance.4,7004,700 instalaciones en skills.sh0
coding-standardsaffaan-mBaseline cross-project coding conventions for naming, readability, immutability, and code-quality review. Use detailed frontend or backend skills for framework-specific patterns. Use when reviewing code quality or naming with no framework-specific skill that applies.4,5004,500 instalaciones en skills.sh0
