hipaa-compliance
starsforks
How to install hipaa-compliance?
bagelhole/devops-security-agent-skills/hipaa-compliance
$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill hipaa-complianceImplement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling healthcare data.
SKILL.md
| 1 | # HIPAA Compliance |
| 2 | |
| 3 | Implement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI). |
| 4 | |
| 5 | ## When to Use |
| 6 | |
| 7 | - Building or operating systems that handle electronic Protected Health Information |
| 8 | - Configuring cloud infrastructure for HIPAA-eligible workloads |
| 9 | - Establishing Business Associate Agreements with vendors |
| 10 | - Implementing technical safeguards for PHI protection |
| 11 | - Preparing for HIPAA compliance audits or OCR investigations |
| 12 | |
| 13 | ## HIPAA Rules and Safeguards |
| 14 | |
| 15 | ```yaml |
| 16 | security_rule: |
| 17 | administrative_safeguards: |
| 18 | 164.308_a_1: "Security Management Process" |
| 19 | actions: |
| 20 | - Conduct risk analysis (required) |
| 21 | - Implement risk management program (required) |
| 22 | - Apply sanction policy for violations (required) |
| 23 | - Review information system activity (required) |
| 24 | |
| 25 | 164.308_a_3: "Workforce Security" |
| 26 | actions: |
| 27 | - Authorization/supervision procedures (addressable) |
| 28 | - Workforce clearance procedure (addressable) |
| 29 | - Termination procedures (addressable) |
| 30 | |
| 31 | 164.308_a_4: "Information Access Management" |
| 32 | actions: |
| 33 | - Access authorization policies (addressable) |
| 34 | - Access establishment and modification (addressable) |
| 35 | - Isolate healthcare clearinghouse functions (required) |
| 36 | |
| 37 | 164.308_a_5: "Security Awareness and Training" |
| 38 | actions: |
| 39 | - Security reminders (addressable) |
| 40 | - Protection from malicious software (addressable) |
| 41 | - Log-in monitoring (addressable) |
| 42 | - Password management (addressable) |
| 43 | |
| 44 | 164.308_a_6: "Security Incident Procedures" |
| 45 | actions: |
| 46 | - Response and reporting procedures (required) |
| 47 | |
| 48 | 164.308_a_7: "Contingency Plan" |
| 49 | actions: |
| 50 | - Data backup plan (required) |
| 51 | - Disaster recovery plan (required) |
| 52 | - Emergency mode operation plan (required) |
| 53 | - Testing and revision procedures (addressable) |
| 54 | - Applications and data criticality analysis (addressable) |
| 55 | |
| 56 | 164.308_a_8: "Evaluation" |
| 57 | actions: |
| 58 | - Periodic technical and nontechnical evaluation (required) |
| 59 | |
| 60 | physical_safeguards: |
| 61 | 164.310_a: "Facility Access Controls" |
| 62 | 164.310_b: "Workstation Use" |
| 63 | 164.310_c: "Workstation Security" |
| 64 | 164.310_d: "Device and Media Controls" |
| 65 | |
| 66 | technical_safeguards: |
| 67 | 164.312_a: "Access Control" |
| 68 | actions: |
| 69 | - Unique user identification (required) |
| 70 | - Emergency access procedure (required) |
| 71 | - Automatic logoff (addressable) |
| 72 | - Encryption and decryption (addressable) |
| 73 | |
| 74 | 164.312_b: "Audit Controls" |
| 75 | actions: |
| 76 | - Implement hardware/software/procedural mechanisms to record and examine access (required) |
| 77 | |
| 78 | 164.312_c: "Integrity" |
| 79 | actions: |
| 80 | - Mechanism to authenticate ePHI (addressable) |
| 81 | |
| 82 | 164.312_d: "Person or Entity Authentication" |
| 83 | actions: |
| 84 | - Verify identity of person/entity seeking access (required) |
| 85 | |
| 86 | 164.312_e: "Transmission Security" |
| 87 | actions: |
| 88 | - Integrity controls (addressable) |
| 89 | - Encryption (addressable) |
| 90 | |
| 91 | privacy_rule: |
| 92 | minimum_necessary: "Limit PHI use, disclosure, and requests to minimum necessary" |
| 93 | individual_rights: "Access, amendment, accounting of disclosures, restrictions" |
| 94 | notice_of_practices: "Provide notice of privacy practices to individuals" |
| 95 | |
| 96 | breach_notification_rule: |
| 97 | individual_notification: "Within 60 days of discovery" |
| 98 | hhs_notification: "Annual for <500 records; within 60 days for 500+" |
| 99 | media_notification: "Required when 500+ individuals in a state/jurisdiction" |
| 100 | ``` |
| 101 | |
| 102 | ## Technical Safeguards Implementation Checklist |
| 103 | |
| 104 | ```yaml |
| 105 | encryption_requirements: |
| 106 | at_rest: |
| 107 | standard: AES-256 |
| 108 | aws_services: |
| 109 | - [ ] RDS encryption enabled (KMS managed key) |
| 110 | - [ ] S3 bucket default encryption (SSE-KMS) |
| 111 | - [ ] EBS volume encryption enabled |
| 112 | - [ ] DynamoDB table encryption (KMS) |
| 113 | - [ ] ElastiCache encryption at rest enabled |
| 114 | - [ ] Redshift cluster encryption enabled |
| 115 | - [ ] EFS encryption enabled |
| 116 | azure_services: |
| 117 | - [ ] Azure SQL TDE enabled (customer-managed key) |
| 118 | - [ ] Storage Account encryption (CMK) |
| 119 | - [ ] Managed Disk encryption (SSE with CMK) |
| 120 | - [ ] Cosmos DB encryption at rest |
| 121 | gcp_services: |
| 122 | - [ ] Cloud SQL encryption (CMEK) |
| 123 | - [ ] Cloud Storage encryption (CMEK) |
| 124 | - [ ] BigQuery encryption (CMEK) |
| 125 | - [ ] Persistent Disk encryption (CMEK) |
| 126 | |
| 127 | in_transit: |
| 128 | standard: TLS 1.2 or higher |
| 129 | checks: |
| 130 | - [ ] TLS 1.2+ enforced on all load balancers |
| 131 | - [ ] HTTP-to-HTTPS redirect enabled |
| 132 | - [ ] Internal service-to-service mTLS configured |
| 133 | - [ ] Database connections use SSL/TLS |
| 134 | - [ ] API gateways enforce TLS minimum version |
| 135 | - [ ] Email encryption for PHI (S/MIME or TLS) |
| 136 | - [ ] VP |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
