| name | rules |
| description | List and search compliance rules in the HipaaLint database. Browse all 266 rules across HIPAA, HITRUST CSF, and SOC 2 Health in 6 categories. Filter by severity or category, and search by keyword. Each rule includes citations and remediation guidance.
|
| user-invocable | true |
| argument-hint | [--category phi_protection] [--severity critical] [--query keyword] |
| allowed-tools | Read, Grep, Glob, Bash |
/rules
List and search HIPAA compliance rules.
Usage
/hipaalint-ai:rules [--category phi_protection] [--severity critical] [--query keyword]
Parameters
--category — Filter by category: phi_protection, encryption, access_control, audit_logging, infrastructure, ai_governance--severity — Filter by severity: critical, high, medium, low--query — Search rules by keyword (searches title, description, and tags)
What It Does
- Queries the HipaaLint rule database (266 rules across HIPAA, HITRUST CSF, and SOC 2 Health)
- Applies optional filters by category, severity, or keyword
- Returns matching rules with ID, title, severity, category, and description
Rule Categories
| Category | Rule Prefixes | Description |
|---|
phi_protection | HIPAA-PHI-*, HITRUST-PHI-*, SOC2H-PHI-* | Protected Health Information safeguards |
encryption | HIPAA-ENC-*, HITRUST-ENC-*, SOC2H-ENC-* | Encryption and data-in-transit/at-rest |
access_control | HIPAA-AC-*, HITRUST-AC-*, SOC2H-AC-* | Authentication and authorization |
audit_logging | HIPAA-LOG-*, HITRUST-LOG-*, SOC2H-LOG-* | Audit trail and monitoring |
infrastructure | HIPAA-INFRA-*, HITRUST-INFRA-*, SOC2H-INFRA-* | Infrastructure security controls |
ai_governance | HIPAA-AI-*, HITRUST-AI-*, SOC2H-AI-* | AI/ML model governance |
Example Output
HipaaLint Rules (266)
HIPAA-PHI-001: PHI in Log Statements
Severity: critical | Category: phi_protection
Detects Protected Health Information written to application logs
HIPAA-ENC-001: Unencrypted HTTP Usage
Severity: critical | Category: encryption
Detects HTTP URLs that should use HTTPS for data in transit
HIPAA-AC-001: Missing Auth Middleware
Severity: high | Category: access_control
Detects API routes handling PHI without authentication middleware
MCP Tool
This skill invokes the compliance_rules MCP tool.
