HIPAA compliance implementation covering technical, administrative, and physical safeguards, Business Associate Agreement checklists, risk assessment methodology, and breach notification procedures. Use when building or reviewing healthcare systems that handle PHI.
インストール
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
HIPAA compliance implementation covering technical, administrative, and physical safeguards, Business Associate Agreement checklists, risk assessment methodology, and breach notification procedures. Use when building or reviewing healthcare systems that handle PHI.
allowed-tools
Read, Grep, Glob, Bash
HIPAA Compliance Implementation
When to use
Designing or auditing encryption for PHI at rest and in transit
Implementing access controls, audit logging, or session management for clinical systems
Evaluating a new vendor and determining BAA requirements
Conducting or documenting a formal HIPAA risk assessment
Responding to a suspected PHI breach and navigating notification timelines
Reviewing workforce training or physical security gaps
Core principles
AES-256-GCM at rest, TLS 1.3 in transit, KMS for keys — these three together cover the encryption baseline; anything less needs a documented exception
Every PHI access gets a log entry — who, what resource, when, from where, and outcome; 6-year retention minimum, tamper-evident storage required
BAA before byte one — no PHI reaches a vendor system without a signed BAA in place; subcontractor flow-down is not optional
Risk assessment is continuous, not annual — reassess after every significant system change, incident, or regulatory update
Breach notification clock starts at discovery — 60 days to notify individuals and HHS; do not wait for the investigation to conclude before starting the clock
