hipaa-code-review-plus

Built on affaan-m/ECC by @affaan-m (258,325 stars, MIT). All credit for the original idea to them. This fork improves and repackages it; upstream license preserved in UPSTREAM_LICENSE.

A Claude Code skill that reviews software for risks involving HIPAA and protected health information.

💡 Why

Health data can leak through logs, links, exports, tests, AI prompts, and support tools.

A hidden button is not an access check. A vendor offering a BAA does not mean every product and data path is covered.

This skill is for developers who build software for US patients, doctors, clinics, health plans, and billing teams. It helps find gaps, record unknowns, and show where legal or security review is still needed.

It does not declare that software is fully HIPAA compliant.

🚀 Install

Run one command:

mkdir -p ~/.claude/skills/hipaa-compliance && curl -fsSL https://raw.githubusercontent.com/hipaa-code-review-plus/hipaa-code-review-plus/main/skill/SKILL.md -o ~/.claude/skills/hipaa-compliance/SKILL.md

🧪 Usage

Ask Claude Code to review a feature:

Use the hipaa-compliance skill to review our AI visit note flow.
Patient audio is sent to a model, saved as a note, and shown to the doctor.

Expected output:

PHI found:
- Patient audio
- Visit text
- Generated note

Blocked:
- The model provider's BAA status is not known.
- Storage and delete rules are not known.

Checks needed:
- Limit access to the care team.
- Keep PHI out of logs and model training.
- Record safe audit events without note text.
- Test wrong users, old sessions, retries, and failed model calls.
- Get legal, privacy, or security review before a final HIPAA finding.

The skill follows a 10-step review. It maps data, checks all parties, limits access, protects stored and sent data, reviews audit records, checks every output, tests failures, and lists open risks.

🔧 What we changed vs upstream

• Rewrites the Japanese description in clear English and narrows activation to identifiable health, treatment, payment, or care data—not merely any health-related app.
• Adds an explicit disclaimer against declaring full HIPAA compliance and requires documenting unknowns plus needed legal or security review.
• Expands the thin overlay into a detailed 10-step review covering data flow, parties, access, protection, auditing, outputs, failure testing, and open risks.
• Strengthens guardrails around test data, authorization, exports, background jobs, vendor BAAs, deletion rules, and model training.
• Reorganizes related skills into actionable guidance, including a fallback when referenced skills are unavailable.

📄 License

This project uses the MIT License. The upstream MIT license and credit are preserved in UPSTREAM_LICENSE.