agentsclimarketplace

Hipaa compliance

Skill goharabbas321/zeoel/skills/hipaa-compliance

Zeoel-AI is a production-grade, multi-agent SaaS software engineering agency. Instead of single, fragile LLM prompts that lose context, Zeoel-AI coordinates a complete team of 33 specialized agents (UX designers, database architects, systems engineers, security auditors, QA engineers, etc.) to brainstorm, plan, build, and verify entire software.

Install
npx -y skills add goharabbas321/zeoel --skill hipaa-compliance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

SKILL.md

3.5 KB, as published. Nobody here has run it

HIPAA Compliance

Use this as the HIPAA-specific entrypoint when a task is clearly about US healthcare compliance. This skill intentionally stays thin and canonical:

  • healthcare-phi-compliance remains the primary implementation skill for PHI/PII handling, data classification, audit logging, encryption, and leak prevention.
  • healthcare-reviewer remains the specialized reviewer when code, architecture, or product behavior needs a healthcare-aware second pass.
  • security-review still applies for general auth, input-handling, secrets, API, and deployment hardening.

When to Use

  • The request explicitly mentions HIPAA, PHI, covered entities, business associates, or BAAs
  • Building or reviewing US healthcare software that stores, processes, exports, or transmits PHI
  • Assessing whether logging, analytics, LLM prompts, storage, or support workflows create HIPAA exposure
  • Designing patient-facing or clinician-facing systems where minimum necessary access and auditability matter

How It Works

Treat HIPAA as an overlay on top of the broader healthcare privacy skill:

  1. Start with healthcare-phi-compliance for the concrete implementation rules.
  2. Apply HIPAA-specific decision gates:
    • Is this data PHI?
    • Is this actor a covered entity or business associate?
    • Does a vendor or model provider require a BAA before touching the data?
    • Is access limited to the minimum necessary scope?
    • Are read/write/export events auditable?
  3. Escalate to healthcare-reviewer if the task affects patient safety, clinical workflows, or regulated production architecture.

HIPAA-Specific Guardrails

  • Never place PHI in logs, analytics events, crash reports, prompts, or client-visible error strings.
  • Never expose PHI in URLs, browser storage, screenshots, or copied example payloads.
  • Require authenticated access, scoped authorization, and audit trails for PHI reads and writes.
  • Treat third-party SaaS, observability, support tooling, and LLM providers as blocked-by-default until BAA status and data boundaries are clear.
  • Follow minimum necessary access: the right user should only see the smallest PHI slice needed for the task.
  • Prefer opaque internal IDs over names, MRNs, phone numbers, addresses, or other identifiers.

Examples

Example 1: Product request framed as HIPAA

User request:

Add AI-generated visit summaries to our clinician dashboard. We serve US clinics and need to stay HIPAA compliant.

Response pattern:

  • Activate hipaa-compliance
  • Use healthcare-phi-compliance to review PHI movement, logging, storage, and prompt boundaries
  • Verify whether the summarization provider is covered by a BAA before any PHI is sent
  • Escalate to healthcare-reviewer if the summaries influence clinical decisions

Example 2: Vendor/tooling decision

User request:

Can we send support transcripts and patient messages into our analytics stack?

Response pattern:

  • Assume those messages may contain PHI
  • Block the design unless the analytics vendor is approved for HIPAA-bound workloads and the data path is minimized
  • Require redaction or a non-PHI event model when possible

Related Skills

  • healthcare-phi-compliance
  • healthcare-reviewer
  • healthcare-emr-patterns
  • healthcare-eval-harness
  • security-review

Gives 0 of the 12 instructions most regulatory compliance skills give

Counted across 187 of the 188 authors here whose files we hold, read 2026-08-06

  • retain audit logs for at least 6 yearsin 10 of 187, across 8 files
  • remove or alter HIPAA identifiersin 9 of 187, across 4 files
  • document patient consent for publicationin 9 of 187, across 4 files
  • stamp files after creating or modifying themin 8 of 187, across 2 files
  • inspect detailed trust scores before modifying filesin 8 of 187, across 2 files
  • check root account mfa statusin 8 of 187, across 2 files
  • check for unused credentials over ninety days oldin 8 of 187, across 2 files
  • check iam users for mfa enforcementin 8 of 187, across 2 files
  • verify cloudtrail is enabled and loggingin 8 of 187, across 2 files
  • check s3 bucket access logging configurationin 8 of 187, across 2 files
  • read existing metadata before modifying filesin 8 of 187, across 2 files
  • run compliance audits using the specified regulationsin 8 of 187, across 2 files

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.