Communitygithub.com

HIPAA合规

针对医疗隐私和安全工作的HIPAA专用入口。当任务明确涉及HIPAA、PHI处理、覆盖实体、BAA、违规态势或美国医疗合规要求时使用。

HIPAA合规 是什么？

该技能作为HIPAA合规任务的专用入口点，专注于美国医疗保健领域的隐私与安全要求。它保持简洁和权威性，明确依赖其他专门技能：`healthcare-phi-compliance`（处理PHI/PII、数据分类、审计日志、加密和防泄漏）、`healthcare-reviewer`（对代码或架构进行医疗审查）和`security-review`（通用安全加固）。此技能指导用户判断任务是否确实涉及HIPAA，并提供一个清晰的决策框架，包括识别PHI数据、确定覆盖实体或业务伙伴关系、确保最小必要访问权限、以及审计追踪。当使用第三方SaaS、可观测性工具或LLM提供商时，要求默认阻止，直到明确BAA状态和数据边界。典型用例包括：处理包含PHI的日志或分析、设计患者或临床医生使用的系统，以及评估供应商或工具对HIPAA工作负载的适用性。

兼容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/affaan-m/everything-claude-code/tree/main/skills/hipaa-compliance
查看原文→浏览所有技能

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

文档

HIPAA合规 是做什么的？

当任务明确涉及美国医疗合规时，将其作为HIPAA专用入口点。此技能有意保持简洁和权威性：

  • healthcare-phi-compliance 仍然是处理PHI/PII、数据分类、审计日志、加密和防泄漏的主要实施技能。
  • healthcare-reviewer 仍然是专门的审查者，当代码、架构或产品行为需要医疗感知的二次检查时使用。
  • security-review 仍然适用于一般的认证、输入处理、密钥、API和部署加固。

使用时机

  • 请求明确提及HIPAA、PHI、覆盖实体、业务伙伴或BAA
  • 构建或审查存储、处理、导出或传输PHI的美国医疗软件
  • 评估日志、分析、LLM提示、存储或支持工作流是否产生HIPAA暴露
  • 设计患者或临床医生使用的系统，其中最小必要访问和可审计性至关重要

工作原理

将HIPAA视为更广泛的医疗隐私技能的覆盖层：

  1. 从 healthcare-phi-compliance 开始，获取具体的实施规则。
  2. 应用HIPAA特定的决策门：
    • 这些数据是PHI吗？
    • 这个参与者是覆盖实体还是业务伙伴？
    • 供应商或模型提供商在接触数据前是否需要BAA？
    • 访问权限是否限制在最小必要范围？
    • 读取/写入/导出事件是否可审计？
  3. 如果任务影响患者安全、临床工作流或受监管的生产架构，则升级到 healthcare-reviewer。

HIPAA特定防护措施

  • 切勿将PHI放入日志、分析事件、崩溃报告、提示或客户端可见的错误字符串中。
  • 切勿在URL、浏览器存储、截图或复制的示例负载中暴露PHI。
  • 要求对PHI的读取和写入进行身份验证访问、范围授权和审计追踪。
  • 将第三方SaaS、可观测性、支持工具和LLM提供商视为默认阻止，直到明确BAA状态和数据边界。
  • 遵循最小必要访问：正确的用户只能看到完成任务所需的最小PHI片段。
  • 优先使用不透明的内部ID，而非姓名、MRN、电话号码、地址或其他标识符。

示例

示例1：以HIPAA为框架的产品请求

用户请求：

在临床医生仪表板中添加AI生成的访问摘要。我们为美国诊所服务，需要保持HIPAA合规。

响应模式：

  • 激活 hipaa-compliance
  • 使用 healthcare-phi-compliance 审查PHI移动、日志、存储和提示边界
  • 在发送任何PHI之前，验证摘要提供者是否被BAA覆盖
  • 如果摘要影响临床决策，则升级到 healthcare-reviewer

示例2：供应商/工具决策

用户请求：

我们能否将支持转录和患者消息发送到分析堆栈中？

响应模式：

  • 假设这些消息可能包含PHI
  • 除非分析供应商被批准用于HIPAA绑定的工作负载且数据路径最小化，否则阻止该设计
  • 尽可能要求脱敏或非PHI事件模型

相关技能

  • healthcare-phi-compliance
  • healthcare-reviewer
  • healthcare-emr-patterns
  • healthcare-eval-harness
  • security-review

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

accessibility

Design, implement, and audit inclusive digital products using WCAG 2.2 Level AA. Use when building or auditing UI that must meet WCAG 2.2 Level AA, or when reviewing a change for keyboard, contrast, or screen-reader support.

affaan-m/claude-api

Anthropic Claude API patterns for Python and TypeScript. Covers Messages API, streaming, tool use, vision, extended thinking, batches, prompt caching, and Claude Agent SDK. Use when building applications with the Claude API or Anthropic SDKs.

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

affaan-m/everything-claude-code

Development conventions and patterns for everything-claude-code. JavaScript project with conventional commits.

affaan-m/everything-claude-code-conventions

Development conventions and patterns for everything-claude-code. JavaScript project with conventional commits.

affaan-m/frontend-design

Create distinctive, production-grade frontend interfaces with high design quality. Use when the user asks to build web components, pages, or applications and the visual direction matters as much as the code quality.

affaan-m/gget

gget CLI and Python workflow for quick genomic database queries, sequence lookup, BLAST-style searches, enrichment checks, and reproducible bioinformatics evidence logs.

affaan-m/literature-review

Systematic literature-review workflow for academic, biomedical, technical, and scientific topics, including search planning, source screening, synthesis, citation checks, and evidence logging.

affaan-m/motion-ui

Production-ready UI motion system for React/Next.js. Use when implementing animations, transitions, or motion patterns.

affaan-m/project-guidelines-example

Example project-specific skill template based on a real production application.

affaan-m/pubmed-database

Direct PubMed and NCBI E-utilities search workflows for biomedical literature, MeSH queries, PMID lookup, citation retrieval, and API-backed literature monitoring.

affaan-m/scholar-evaluation

Structured scholarly-work evaluation for papers, proposals, literature reviews, methods sections, evidence quality, citation support, and research-writing feedback.

affaan-m/uspto-database

USPTO patent and trademark data workflow for official record lookup, PatentSearch queries, TSDR checks, assignment data, and reproducible IP research logs.

agent-architecture-audit

Full-stack diagnostic for agent and LLM applications. Audits the 12-layer agent stack for wrapper regression, memory pollution, tool discipline failures, hidden repair loops, and rendering corruption. Produces severity-ranked findings with code-first fixes. Essential for developers building agent applications, autonomous loops, or any LLM-powered feature. Use when an agent or LLM feature misbehaves and the failing layer is unknown, or before shipping an agent stack.

agent-eval

Head-to-head comparison of coding agents (Claude Code, Aider, Codex, etc.) on custom tasks with pass rate, cost, time, and consistency metrics. Use when choosing between coding agents, or when a change to an agent setup needs measured pass rate, cost, and time rather than an impression.

agent-harness-construction

Design and optimize AI agent action spaces, tool definitions, and observation formatting for higher completion rates. Use when defining or revising an agent

agentic-engineering

Operate as an agentic engineer using eval-first execution, decomposition, and cost-aware model routing. Use when planning or executing engineering work that agents will carry out end to end.

agentic-os

Build persistent multi-agent operating systems on Claude Code. Covers kernel architecture, specialist agents, slash commands, file-based memory, scheduled automation, and state management without external databases. Use when building a persistent multi-agent system on Claude Code with its own memory, commands, and scheduling.

agent-introspection-debugging

Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports. Use when an agent run fails and you need a reproducible diagnosis instead of a retry.

agent-payment-x402

Add x402 payment execution to AI agents with per-task budgets, spending controls, and non-custodial wallets. Supports Base through agentwallet-sdk and X Layer through OKX Payments / OKX Agent Payments Protocol. Use when an agent must pay for something itself and needs per-task budgets, spending controls, and a non-custodial wallet.

相关技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community