CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

hipaa-compliance

Expert HIPAA compliance assistant for healthcare and software contexts. Use this skill whenever the user mentions HIPAA, PHI (Protected Health Information), ePHI, covered entities, business associates, healthcare data privacy, medical records, health information security, BAA (Business Associate Agreements), or any compliance review involving patient data. Also trigger for requests to draft privacy notices, HIPAA policies, consent forms, security risk assessments, or breach notification letters. Use for developers building healthcare software who need technical safeguard guidance (encryption, access controls, audit logs), compliance officers reviewing documents or procedures, and anyone asking "is this HIPAA compliant?" or "what does HIPAA require for X?". When in doubt about whether a healthcare or data privacy question falls under this skill — use it.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with strong progressive disclosure (a clean overview table routing to four verified, well-organized reference files) and largely actionable templates and checklists. Its weakest area is token efficiency: it restates concepts Claude already knows and carries a time-sensitive enforcement-news section that inflates the overview and will age quickly.

Suggestions

Trim or relocate basic-concept restatements (the PHI definition, TPO explanation, and "Tone & Approach" section) that Claude can already infer, keeping only the domain-specific specifics like CFR citations and the 18-identifier enumeration.

Move the September 2026 enforcement-and-rulemaking news (settlement names, dollar amounts, Unified Agenda dates) into a dedicated dated reference file or a clearly bounded "Regulatory status" appendix so the overview stays lean and the volatile content can be updated in one place.

Add a brief pre-delivery validation step to each workflow (e.g., confirm the disclaimer is included and every cited regulation uses the `45 CFR §164.[section]` format) to close the workflow-clarity validation gap.

DimensionReasoningScore

Conciseness

Well-organized but includes material Claude already knows (e.g., "PHI = Individually identifiable health information…", TPO definitions), an inferable "Tone & Approach" section, and a dense time-sensitive enforcement-news block with specific 2025–2027 dates and dollar amounts not placed in a deprecated/status-style section — per the rubric this costs conciseness. Fits "mostly efficient but could be tightened," not the noticeably-verbose anchor 2.

3 / 5

Actionability

Provides copy-paste-ready output skeletons (structured review template with issue table and risk levels; technical assessment checklist with exact citations like "§164.312(a)(2)(i)") and specific requirements ("AES-256 at rest, TLS 1.2+ in transit", "[ORGANIZATION NAME]" placeholders). Falls short of anchor 5 only because no worked finished example is shown and a few directives remain abstract ("Use concrete examples relevant to the user's context").

4 / 5

Workflow Clarity

Each use case has a clear sequence ("1. Identify scope… 2. Load relevant reference files 3. Structured review output") with checklist-style checkpoints (the mandatory disclaimer, the "Always:" requirements for document generation). Minor validation gaps — no step confirming citations/disclaimer before delivering output — keep it at anchor 4 rather than 5.

4 / 5

Progressive Disclosure

The body is a clear overview with a "When to load" table pointing to four real, one-level-deep reference files (all verified present on disk), with bulk detail appropriately split into them and easy navigation — matching the top anchor. The inline "Key HIPAA Concepts" section is a compact distillation, not misplaced bulk detail.

5 / 5

Total

16

/

20

Passed

Description

91%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states concrete capabilities, provides comprehensive natural trigger terms including quoted user questions, and explicitly covers both what and when. Its only weaknesses are a slightly generic opening frame and a broad catch-all clause that modestly raises conflict risk with general data-privacy skills.

DimensionReasoningScore

Specificity

Enumerates several concrete capabilities ("draft privacy notices, HIPAA policies, consent forms, security risk assessments, or breach notification letters"; "technical safeguard guidance (encryption, access controls, audit logs)"; compliance review), but the generic opening "Expert HIPAA compliance assistant" and the unstated education/explanation capability leave minor gaps, matching anchor 4.

4 / 5

Completeness

Explicitly answers both: what (compliance review, document drafting, and technical safeguard guidance for healthcare/software contexts) and when ("Use this skill whenever the user mentions…" with concrete trigger phrases and audience cases), matching the anchor requiring both with concrete triggers.

5 / 5

Trigger Term Quality

Covers natural terms comprehensively — "HIPAA, PHI (Protected Health Information), ePHI, covered entities, business associates, healthcare data privacy, medical records, health information security, BAA" — plus verbatim user phrasings like "is this HIPAA compliant?" and "what does HIPAA require for X?", matching the comprehensive-synonyms anchor.

5 / 5

Distinctiveness Conflict Risk

The HIPAA/PHI/BAA triggers define a clear niche, but "When in doubt about whether a healthcare or data privacy question falls under this skill — use it" widens triggering to generic data-privacy questions, creating minor overlap risk with general privacy skills (anchor 4, not 5).

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/hipaa-compliance/skills/hipaa-compliance/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.