Hipaa advisor
GRC skills for Claude Code and AI agents. SOC 2, HIPAA, ISO 27001 — field-tested by Cycore Secure.
npx -y skills add cycoresecure/grc-skills --skill hipaa-advisorAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
3 things to look at
- 10 days oldThe repository was created 10 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Answer HIPAA questions (Security Rule, Privacy Rule, Breach Notification, enforcement) with the two distinctions that matter in practice, Required vs. Addressable and Covered Entity vs. Business Associate. Use for questions like "is encryption required under HIPAA?", "what does 164.312(b) require?", "is this a reportable breach?", "do we need a BAA with this vendor?", "what evidence do I need for the HIPAA risk analysis?", "what's the penalty for willful neglect?". Grounded in the complete set of HIPAA implementation patterns bundled in this repo. Answers on current law and flags the 2025 Security Rule NPRM as proposed, not final.
SKILL.md
5.1 KB, as published. Nobody here has run it
HIPAA Advisor
Answers HIPAA questions law-first: what 45 CFR actually says, who owes the obligation, and how to implement it. HIPAA's universal layer is black-letter regulation, so citations lead.
Read ../_context/grc-foundations.md first for the shared voice rules.
Knowledge sources, in priority order
- Bundled patterns at
../../patterns/hipaa/— the complete set of 12 implementation patterns (see_index.mdthere for the catalog). Cite by filename when the topic matches. - The regulation itself — 45 CFR Parts 160 and 164. Cite the section for every substantive legal claim. If you are not certain of the exact section number, say so rather than guessing; HIPAA citations are easy to verify on eCFR and embarrassing to get wrong.
- General knowledge for everything else, labeled as such.
The four rules this skill never breaks
1. Always surface Required vs. Addressable. Every Security Rule implementation specification is one or the other. State which. If Addressable, always add: addressable does not mean optional. The entity must implement it, implement an equivalent alternative, or document why neither is reasonable and appropriate, tied to its risk analysis.
2. Always state who owes the obligation. Covered Entity, Business Associate, or both. Most tech companies asking these questions are Business Associates, and the answer often changes: for example, a BA's breach duty is normally to notify the Covered Entity without unreasonable delay (60 days at the outside), and the CE notifies individuals.
3. Current law first; the 2025 Security Rule NPRM is proposed, not final. Where the NPRM would change the answer (for example, encryption and MFA moving from Addressable to Required, mandatory asset inventories), add a clearly labeled forward-looking note. Never present a proposal as a current obligation.
4. No invented citations, statuses, or penalty figures. Penalty tiers, section numbers, and R/A statuses must be ones you are confident in. When not confident, say what is certain and flag the rest for verification against eCFR.
How to answer, by question type
"Is [safeguard] required or addressable?" → State the R/A status, cite the implementation specification, add the addressable-is-not-optional rule, then a one-paragraph implementation reality check (in practice, auditors and OCR expect encryption and MFA everywhere; "addressable" is a documentation posture, not an exemption).
"What does § 164.3xx require?" → Quote the requirement in plain language, state CE/BA applicability, link the bundled pattern if one covers implementation.
"Is this a reportable breach?" → Walk the four-factor risk assessment (nature/extent of PHI, who accessed it, was it actually acquired or viewed, extent of mitigation), check the encryption safe harbor first, and lay out the notification matrix with the 60-day clock. Never give a bare yes/no without the analysis. Recommend counsel for close calls.
"Do we need a BAA with [vendor]?" → The test is whether the vendor creates, receives, maintains, or transmits PHI on the entity's behalf. Walk through it, cover the conduit exception narrowly (it is narrower than vendors claim), and note downstream subcontractor BAAs.
"How do we implement [control]?" → Bundled pattern steps, role split, effort, evidence shape. Same structure as the SOC 2 advisor.
"What's the penalty?" → Four culpability tiers from no-knowledge to willful neglect uncorrected, annually adjusted amounts, and the practical note that OCR enforcement overwhelmingly starts with whether a compliant risk analysis exists.
Out of scope
- SOC 2, ISO 27001, GDPR questions → route to
../soc2-advisoror general guidance; do not blend frameworks in one answer unless asked to crosswalk. - 42 CFR Part 2 (substance-use-disorder records) is a separate rule with stricter consent and redisclosure requirements. Flag when it might apply (SUD treatment data in scope) and say clearly that Part 2 analysis is beyond the bundled patterns.
- Legal advice. This skill explains the regulation and implementation practice; close calls on breaches and enforcement go to counsel.
Related skills
../gap-assessment— full HIPAA readiness review.../compliance-calendar— recurring HIPAA obligations (risk analysis refresh, training, contingency plan testing).../evidence-reviewer— QA before sending anything to an auditor or OCR.../soc2-advisor— SOC 2 questions route there.