菜单
Assess a target system against HIPAA Privacy Rule, Security Rule, and Breach Notification Rule using the hipaa-foundation repository, including entity-role triage, addressable-spec handling, domain selection, evidence mapping, and structured draft output.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill hipaa-assessor命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | hipaa-assessor |
| title | HIPAA Assessor |
| description | Assess a target system against HIPAA Privacy Rule, Security Rule, and Breach Notification Rule using the hipaa-foundation repository, including entity-role triage, addressable-spec handling, domain selection, evidence mapping, and structured draft output. |
| author | nickzren |
| author_url | https://github.com/nickzren/hipaa-foundation/tree/main/skills/hipaa-assessor |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | healthcare |
| language | en |
Use this skill to produce conservative draft HIPAA assessments of software systems.
This skill is the workflow layer only. It is not the knowledge base itself. The canonical corpus stays in the hipaa-foundation repository under core/.
For fast navigation inside this skill package, start with START-HERE.md and references/index.yaml. They point back to canonical files under the resolved foundation repo. They do not replace them.
FOUNDATION_ROOT/core/regulations/*.yaml authoritative_text — binding regulatory textFOUNDATION_ROOT/core/guidance/*.yaml — OCR guidance and interpretive contextFOUNDATION_ROOT/core/domains/*.yaml and checklist files — non-authoritative assessment guidanceUse this skill when:
hipaa-foundation repository is available directly or through a separate checkoutBefore starting, you need:
hipaa-foundation repositoryIf the target system or foundation root cannot be identified, stop and ask for the missing path. Otherwise inspect the target repo first and ask follow-up questions only if the assessment is still blocked.
Resolve the foundation root before reading any core/ files.
Resolution order (implemented in scripts/resolve-foundation-root.sh):
HIPAA_FOUNDATION_ROOT environment variable (fail closed if set but invalid)${XDG_CONFIG_HOME:-$HOME/.config}/hipaa-assessor/config (single line, absolute path)$HOME/github/hipaa-foundation.git, check sibling)Run scripts/resolve-foundation-root.sh from this skill package. Once resolved, treat that absolute path as and read all referenced files from there.
FOUNDATION_ROOTBefore triage, explore the target repo directly. Use code, docs, infrastructure config, tests, and any in-repo architecture or procedural material as assessment evidence.
Ask follow-up questions only when a required decision cannot be derived from the reviewed corpus and the assessment would otherwise be blocked.
Read:
FOUNDATION_ROOT/core/provenance/content-policy.yamlFOUNDATION_ROOT/core/provenance/decision-log.yamlDo not use the repo in a way that violates the content policy.
Read:
FOUNDATION_ROOT/core/applicability/triage.yamlFOUNDATION_ROOT/core/applicability/triage-output-template.yamlEntity type must be determined from evidence in the reviewed corpus: governance documents, BAAs, formal scope statements, or explicit entity classification records. Do not infer entity type from system function, clinical branding, device names, or health-data content. If the corpus does not confirm entity type, use tbd with low confidence.
When entity_type is tbd and ePHI is clearly in scope, the usual applicable_rules posture is security_rule, breach_notification_rule, and enforcement_rule. Do not add privacy_rule unless entity status is confirmed from the corpus. Always include enforcement_rule for context.
Before selecting domains, produce a structured triage block.
At minimum include:
entity_type (covered_entity, business_associate, ba_subcontractor, not_regulated, tbd)covered_entity_type (provider, health_plan, clearinghouse, not_applicable, tbd)hybrid_entity_status (yes, no, tbd)entity_type_confidence (low, medium, high)phi_types_in_scopephi_scope_confidence (low, medium, high)evidence_basis (repo-only, repo-plus-external-evidence, repo-plus-runtime-or-interviews)assessment_confidence (low, medium, high)applicable_rulespart_162_assessment_mode (not_in_scope_v1, applicability_only, full_module)state_law_overlay_status (out_of_scope_v1, identified, tbd)in_scope_domainsexcluded_domainsopen_decisionsAfter producing the triage block:
domain_selection_rules from triage.yaml to populate in_scope_domains.in_scope_domains. Skip excluded domains entirely.entity-and-applicability in working context throughout the assessment. It governs downstream scope judgments.entity_type is tbd, read FOUNDATION_ROOT/docs/example-assessment-entity-tbd.md for patterns on handling unconfirmed entity type, excluded Privacy domains, and evidence-basis limitations.entity_type is business_associate or ba_subcontractor, read FOUNDATION_ROOT/docs/example-assessment-ba.md for BA-specific assessment patterns.entity_type is covered_entity, read FOUNDATION_ROOT/docs/example-assessment.md for covered-entity assessment patterns.If entity_type is not_regulated, state why and stop.
Read:
FOUNDATION_ROOT/core/index/domain-inventory.yamlSelect domains from the canonical inventory based on entity type, applicable rules, and PHI scope.
Read:
FOUNDATION_ROOT/core/checklists/evidence-map.yamlUse the evidence map while exploring:
Evidence basis branching:
evidence_basis is repo-only, read the repo_only_notes in each in-scope domain file's assessment_guidance before scanning. These notes identify which controls are typically organizational and should not be rated Gap on repo-only evidence alone.evidence_basis includes external evidence, also consult the external evidence expectations in each domain's regulation files.Read:
FOUNDATION_ROOT/core/checklists/assessment-rubric.yamlFor each in-scope domain:
review_questions, deep_assessment_probes, assessment_guidance).regulation_files/standards for orientation.regulation_files/implementation_specifications for detail on each standard's required and addressable specs.Read all listed regulation files for the current domain before moving to the next domain. Do not front-load regulation files for all domains at once. Work domain by domain.
For every in-scope domain:
implemented, alternative, documented_exception, or not_evidencedAdequate, not a gapAddressable-spec handling:
required + implemented -> Adequaterequired + not implemented -> Gapaddressable + implemented -> Adequateaddressable + alternative (documented) -> Adequateaddressable + documented_exception (documented risk basis) -> Adequateaddressable + not_evidenced -> Partial or Not assessed depending on evidence basisRepo-only realism rule:
Many HIPAA obligations are organizational. On repo-only evidence, the following should typically be Not assessed or Partial, not Gap:
Domain severity anchors:
Minor or ObservationUse:
FOUNDATION_ROOT/docs/assessment-output-template.mdEvery output must:
This is a draft assessment for human compliance review. It is not a compliance determination and not a substitute for legal counsel.addressable_disposition column for Security Rule specsAdequate or Not applicablebasis_type for each non-trivial findingIf part11-foundation is also being used:
part11-foundation own Part 11 record/signature scope and control ratingshipaa-foundation own HIPAA Privacy/Security/Breach findingsIf gamp5-foundation is also being used:
gamp5-foundation own lifecycle, validation, and supplier methodologyRun:
FOUNDATION_ROOT/core/checklists/assessment-self-review.mdIf any check fails, go back and correct the assessment.
If the available information is not enough to answer a triage question or assess a domain:
Not assessed or Partial, whichever the rubric supports