菜单
HIPAA establishes national standards for protecting patient health information (PHI). Enforced by HHS Office for Civil Rights.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Orchestration & Events:
Kubernetes standards for container orchestration, deployments, services, ingress, ConfigMaps, Secrets, and security policies. Covers production-ready configurations, monitoring, and best practices for cloud-native applications.
Master Kotlin coding standards with null safety, coroutines, and idiomatic patterns. Use when developing JVM/Android applications requiring type-safe async programming.
Comprehensive coding standards and best practices for maintainable, consistent software development across multiple languages and paradigms
React frontend standards covering hooks (useState, useEffect, useContext, custom hooks), state management (Context API, Redux, Zustand), performance optimization (memoization, lazy loading, code splitting), testing with React Testing Library, and accessibility (WCAG 2.1, ARIA) for modern SPAs
Security Operations Center (SOC) practices, incident response, SIEM management, and threat hunting following NIST 800-61
| name | healthtech-hipaa |
| category | compliance |
| difficulty | advanced |
| compliance_standards | ["HIPAA","HITECH","HL7-v2","FHIR-R4"] |
| version | 1.0.0 |
| last_updated | "2025-10-17T00:00:00.000Z" |
| description | HIPAA establishes national standards for protecting patient health information (PHI). Enforced by HHS Office for Civil Rights. |
LEGAL DISCLAIMER: This document provides educational guidance on HIPAA compliance requirements and is not legal advice. Healthcare organizations must consult with qualified healthcare compliance attorneys and privacy officers to ensure full regulatory compliance. HIPAA regulations are complex and fact-specific; implementation must be tailored to your organization's specific circumstances.
HIPAA establishes national standards for protecting patient health information (PHI). Enforced by HHS Office for Civil Rights.
Key Rules:
Core Requirements:
Penalties: $100-$50,000 per violation (up to $1.5M annually per category)
📚 Full Examples: See REFERENCE.md for complete code samples, detailed configurations, and production-ready implementations.
Implementation Guide (~1200 tokens)
HIPAA compliance requires a systematic approach across three main pillars:
Privacy Rule Implementation: Establish policies for PHI use/disclosure, implement individual rights (access, amendment, accounting), deploy Notice of Privacy Practices, and enforce minimum necessary standard through role-based access controls.
Security Rule Implementation: Conduct annual risk assessments, designate Security Official, implement administrative safeguards (workforce security, training, incident response, contingency planning), deploy physical safeguards (facility access, workstation security, device controls), and enforce technical safeguards (access control, encryption, audit logging, authentication, transmission security).
Business Associate Management: Identify all vendors with PHI access, execute Business Associate Agreements before PHI disclosure, monitor BA compliance, and maintain BA tracking logs.
Phase 1: Foundation (Weeks 1-4)
Phase 2: Technical Controls (Weeks 5-12)
Phase 3: Administrative & Physical (Weeks 13-20)
Phase 4: Testing & Validation (Weeks 21-24)
Encryption Requirements:
Access Control Essentials:
Audit Logging Must-Haves:
Breach Definition: Acquisition, access, use, or disclosure of unsecured PHI compromising security/privacy.
Notification Timelines:
Risk Assessment (4 factors):
HITECH Penalty Tiers (per violation):
HL7 v2 Security: Encrypt message transmission with TLS over MLLP, implement certificate-based authentication for interface connections, log all message transmissions, and validate message schemas before processing.
FHIR R4 Compliance: Implement SMART on FHIR (OAuth 2.0 + OpenID Connect), enforce TLS 1.2+ for all API calls, use OAuth scopes for minimum necessary access control, log all FHIR API requests, deploy rate limiting, and execute BAAs with app developers.
For detailed implementation guidance including:
See REFERENCE.md for complete list.
See the comprehensive implementation guide: HIPAA Implementation Guide
Official Resources: HHS OCR, HIPAA Security, NIST SP 800-66, HL7, FHIR R4
Related Skills: security/OWASP, security/NIST-CSF, governance/SOC2, data-privacy/GDPR
Last Updated: 2025-10-17
Change Log:
Regulatory Monitoring: HIPAA regulations are subject to updates and guidance changes. Monitor:
Skill Maintenance:
// TODO: Add basic example for healthtech
// This example demonstrates core functionality
// TODO: Add advanced example for healthtech
// This example shows production-ready patterns
// TODO: Add integration example showing how healthtech
// works with other systems and services
See examples/healthtech/ for complete working examples.
This skill integrates with:
Problem: Not testing edge cases and error conditions leads to production bugs
Solution: Implement comprehensive test coverage including:
Prevention: Enforce minimum code coverage (80%+) in CI/CD pipeline
Problem: Hardcoding values makes applications inflexible and environment-dependent
Solution: Use environment variables and configuration management:
Prevention: Use tools like dotenv, config validators, and secret scanners
Problem: Security vulnerabilities from not following established security patterns
Solution: Follow security guidelines:
Prevention: Use security linters, SAST tools, and regular dependency updates
Best Practices:
Remember: HIPAA compliance is an ongoing process, not a one-time project. Establish continuous monitoring, regular training, and periodic assessments to maintain compliance posture.