| name | hipaa-compliance-check |
| title | HIPAA Compliance Check Skill |
| description | Use when performing hipaa compliance check — hIPAA compliance review covering
PHI handling, encryption requirements, access controls, audit logging,
Business Associate Agreements, and breach notification readiness. Use for
healthcare application assessments, vendor onboarding, or annual compliance
reviews. |
| author | cloudthinker-ai |
| author_url | https://github.com/cloudthinker-ai/CloudSkills/tree/main/skills/templates/hipaa-compliance-check |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | healthcare |
| language | en |
HIPAA Compliance Check Skill
Perform a HIPAA compliance review for {{ system_name }} handling {{ phi_types }} as a {{ covered_entity }}.
Workflow
Step 1 — PHI Data Mapping
Identify where PHI exists in the system:
- Data at rest: Databases, file storage, backups, archives
- Data in transit: API calls, message queues, email, file transfers
- Data in use: Application memory, caches, logs, analytics
- Data derivatives: Reports, exports, de-identified datasets
Document each PHI touchpoint with data type, location, and classification.
Step 2 — Administrative Safeguards (§164.308)
ADMINISTRATIVE SAFEGUARDS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Security Officer designated
[ ] Risk analysis conducted within last 12 months
[ ] Risk management plan documented and active
[ ] Workforce security: background checks for PHI access
[ ] Security awareness training completed by all workforce members
[ ] Sanctions policy for security violations documented
[ ] Information system activity review (audit log review) on schedule
[ ] Contingency plan: data backup, disaster recovery, emergency operations
[ ] Business Associate Agreements (BAAs) in place with all vendors handling PHI
[ ] BAA inventory current and reviewed annually
Step 3 — Physical Safeguards (§164.310)
PHYSICAL SAFEGUARDS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Facility access controls documented
[ ] Workstation use policies defined
[ ] Workstation security (screen lock, encryption)
[ ] Device and media controls for disposal and re-use
[ ] Cloud provider BAA covers physical security (AWS/GCP/Azure)
Step 4 — Technical Safeguards (§164.312)
TECHNICAL SAFEGUARDS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ACCESS CONTROL
[ ] Unique user identification for all PHI access
[ ] Emergency access procedure documented
[ ] Automatic session timeout (≤15 min inactivity)
[ ] Encryption of PHI at rest (AES-256 or equivalent)
AUDIT CONTROLS
[ ] Audit logs capture all PHI access (read, write, delete)
[ ] Audit logs are immutable and retained ≥6 years
[ ] Audit log review performed regularly
[ ] Failed login attempts logged and alerted
INTEGRITY CONTROLS
[ ] Data integrity checks on PHI (checksums, validation)
[ ] Mechanism to authenticate electronic PHI
TRANSMISSION SECURITY
[ ] PHI encrypted in transit (TLS 1.2+)
[ ] Email containing PHI encrypted
[ ] API endpoints handling PHI require authentication
[ ] VPN or private connectivity for PHI data flows
Step 5 — Breach Notification Readiness (§164.400)
BREACH NOTIFICATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Breach detection mechanisms in place
[ ] Breach risk assessment process documented
[ ] Individual notification procedure (within 60 days)
[ ] HHS notification procedure documented
[ ] Media notification procedure (>500 individuals)
[ ] Breach log maintained
[ ] Annual breach notification drill conducted
