Communitygithub.com

HIPAA 合規

針對醫療保健隱私與安全工作的 HIPAA 特定切入點。當任務明確涉及 HIPAA、PHI 處理、涵蓋實體、BAA、違規態勢或美國醫療合規要求時使用。

HIPAA 合規 是什麼？

此技能專門針對需要遵守美國醫療保健法規（特別是 HIPAA）的任務。它作為一個輕量級的入口，將具體實作細節委派給更專業的技能，例如處理 PHI/PII、資料分類和稽核記錄的 `healthcare-phi-compliance`，以及專注於程式碼與架構審查的 `healthcare-reviewer`。其核心是確保處理受保護健康資訊 (PHI) 的系統遵循「最低必要」存取原則、要求所有 PHI 存取具有稽核軌跡，並嚴格限制 PHI 暴露於日誌、分析或第三方服務中。此技能透過強制執行 BAA（業務合作協議）要求以及使用內部 ID 而非姓名或病歷號碼等可識別資訊來有效管理風險。

相容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/affaan-m/ECC/tree/main/skills/hipaa-compliance
查看原文→瀏覽所有技能

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

說明文件

HIPAA 合規 是做什麼的？

當任務明確與美國醫療保健合規相關時，使用此技能作為 HIPAA 的特定入口。此技能刻意保持精簡且權威：

  • healthcare-phi-compliance 仍是 PHI/PII 處理、資料分類、稽核記錄、加密及洩漏防護的主要實作技能。
  • healthcare-reviewer 仍是專門的審查員，當程式碼、架構或產品行為需要醫療保健意識的第二重檢查時使用。
  • security-review 仍適用於一般的身分驗證、輸入處理、機密、API 及部署強化。

使用時機

  • 請求明確提及 HIPAA、PHI、涵蓋實體、業務合作夥伴或 BAA
  • 建置或審查儲存、處理、匯出或傳輸 PHI 的美國醫療保健軟體
  • 評估日誌、分析、LLM 提示、儲存或支援工作流程是否會造成 HIPAA 暴露風險
  • 設計面向患者或臨床醫生的系統，其中最低必要存取和可稽核性至關重要

運作方式

將 HIPAA 視為更廣泛醫療保健隱私技能的上層覆蓋：

  1. 從 healthcare-phi-compliance 開始，取得具體的實作規則。
  2. 套用 HIPAA 特定的決策關卡：
    • 此資料是否為 PHI？
    • 此行為者是否為涵蓋實體或業務合作夥伴？
    • 廠商或模型提供者是否需要 BAA 才能接觸資料？
    • 存取權限是否限制在最低必要的範圍內？
    • 讀取/寫入/匯出事件是否可稽核？
  3. 如果任務影響患者安全、臨床工作流程或受法規規範的生產架構，則升級至 healthcare-reviewer。

HIPAA 特定護欄

  • 絕不要將 PHI 置於日誌、分析事件、崩潰報告、提示或客戶可見的錯誤字串中。
  • 絕不要將 PHI 暴露於 URL、瀏覽器儲存、螢幕截圖或複製的範例有效負載中。
  • 對於 PHI 的讀取和寫入，要求經過驗證的存取、限定範圍的授權以及稽核軌跡。
  • 預設封鎖第三方 SaaS、可觀測性工具、支援工具和 LLM 提供者，直到釐清 BAA 狀態和資料邊界為止。
  • 遵循最低必要存取原則：正確的使用者應僅能看到完成任務所需的最小 PHI 片段。
  • 優先使用不透明的內部 ID，而非姓名、病歷號碼、電話號碼、地址或其他識別符。

範例

範例 1：以 HIPAA 為框架的產品請求

使用者請求：

在我們的臨床醫生儀表板中加入 AI 生成的訪談摘要。我們服務美國診所，需要保持 HIPAA 合規。

回應模式：

  • 啟動 hipaa-compliance
  • 使用 healthcare-phi-compliance 審查 PHI 的流動、日誌記錄、儲存和提示邊界
  • 在發送任何 PHI 之前，確認摘要生成提供者是否已簽署 BAA
  • 如果摘要影響臨床決策，則升級至 healthcare-reviewer

範例 2：廠商/工具決策

使用者請求：

我們可以將支援對話記錄和患者訊息發送到我們的分析平台嗎？

回應模式：

  • 假設這些訊息可能包含 PHI
  • 除非分析供應商已獲准處理 HIPAA 工作負載且資料路徑已最小化，否則封鎖該設計
  • 在可能的情況下，要求進行去識別化處理或採用非 PHI 的事件模型

相關技能

  • healthcare-phi-compliance
  • healthcare-reviewer
  • healthcare-emr-patterns
  • healthcare-eval-harness
  • security-review

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

accessibility

Design, implement, and audit inclusive digital products using WCAG 2.2 Level AA. Use when building or auditing UI that must meet WCAG 2.2 Level AA, or when reviewing a change for keyboard, contrast, or screen-reader support.

affaan-m/content-engine

Create platform-native content systems for X, LinkedIn, TikTok, YouTube, newsletters, and repurposed multi-platform campaigns. Use when the user wants social posts, threads, scripts, content calendars, or one source asset adapted cleanly across platforms.

affaan-m/ECC

Multi-platform content distribution across X, LinkedIn, Threads, and Bluesky. Adapts content per platform using content-engine patterns. Never posts identical content cross-platform. Use when the user wants to distribute content across social platforms.

affaan-m/fal-ai-media

Unified media generation via fal.ai MCP — image, video, and audio. Covers text-to-image (Nano Banana), text/image-to-video (Seedance, Kling, Veo 3), text-to-speech (CSM-1B), and video-to-audio (ThinkSound). Use when the user wants to generate images, videos, or audio with AI.

affaan-m/manim-video

日本語翻訳：このファイルは manim-video 用の日本語翻訳が必要です

affaan-m/remotion-video-creation

Remotion のベストプラクティス - React で動画を作成する。3D、アニメーション、音声、字幕、チャート、トランジションなどをカバーするドメイン固有の29のルール。

affaan-m/video-editing

AI-assisted video editing workflows for cutting, structuring, and augmenting real footage. Covers the full pipeline from raw capture through FFmpeg, Remotion, ElevenLabs, fal.ai, and final polish in Descript or CapCut. Use when the user wants to edit video, cut footage, create vlogs, or build video content.

agent-architecture-audit

Full-stack diagnostic for agent and LLM applications. Audits the 12-layer agent stack for wrapper regression, memory pollution, tool discipline failures, hidden repair loops, and rendering corruption. Produces severity-ranked findings with code-first fixes. Essential for developers building agent applications, autonomous loops, or any LLM-powered feature. Use when an agent or LLM feature misbehaves and the failing layer is unknown, or before shipping an agent stack.

agent-eval

Head-to-head comparison of coding agents (Claude Code, Aider, Codex, etc.) on custom tasks with pass rate, cost, time, and consistency metrics. Use when choosing between coding agents, or when a change to an agent setup needs measured pass rate, cost, and time rather than an impression.

agent-harness-construction

Design and optimize AI agent action spaces, tool definitions, and observation formatting for higher completion rates. Use when defining or revising an agent

agentic-engineering

Operate as an agentic engineer using eval-first execution, decomposition, and cost-aware model routing. Use when planning or executing engineering work that agents will carry out end to end.

agentic-os

Build persistent multi-agent operating systems on Claude Code. Covers kernel architecture, specialist agents, slash commands, file-based memory, scheduled automation, and state management without external databases. Use when building a persistent multi-agent system on Claude Code with its own memory, commands, and scheduling.

agent-introspection-debugging

Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports. Use when an agent run fails and you need a reproducible diagnosis instead of a retry.

agent-payment-x402

Add x402 payment execution to AI agents with per-task budgets, spending controls, and non-custodial wallets. Supports Base through agentwallet-sdk and X Layer through OKX Payments / OKX Agent Payments Protocol. Use when an agent must pay for something itself and needs per-task budgets, spending controls, and a non-custodial wallet.

agent-self-evaluation

Use after completing any non-trivial task. The agent self-rates its output on 5 axes — accuracy, completeness, clarity, actionability, conciseness — with concrete evidence per criterion. Produces a structured 1-5 scorecard with specific improvement suggestions.

agent-sort

Build an evidence-backed ECC install plan for a specific repo by sorting skills, commands, rules, hooks, and extras into DAILY vs LIBRARY buckets using parallel repo-aware review passes. Use when ECC should be trimmed to what a project actually needs instead of loading the full bundle.

ai-first-engineering

Engineering operating model for teams where AI agents generate a large share of implementation output. Use when setting team process, review gates, or ownership rules for a codebase largely written by agents.

ai-regression-testing

Regression testing strategies for AI-assisted development. Sandbox-mode API testing without database dependencies, automated bug-check workflows, and patterns to catch AI blind spots where the same model writes and reviews code. Use when adding regression coverage to AI-assisted code, or when the same model both wrote and reviewed a change.

android-clean-architecture

Clean Architecture patterns for Android and Kotlin Multiplatform projects — module structure, dependency rules, UseCases, Repositories, and data layer patterns. Use when structuring modules, layers, or data flow in an Android or KMP project.

angular-developer

Generates Angular code and provides architectural guidance. Trigger when creating projects, components, or services, or for best practices on reactivity (signals, linkedSignal, resource), forms, dependency injection, routing, SSR, accessibility (ARIA), animations, styling (component styles, Tailwind CSS), testing, or CLI tooling.

相關技能

steipete/video-frames

Extract frames or short clips from videos using ffmpeg.

community

steipete/summarize

Summarize or transcribe URLs, YouTube/videos, podcasts, articles, transcripts, PDFs, and local files.

community

openclaw/openclaw

Use when testing, fixing, or extending the OpenClaw Control UI GUI with Vitest + Playwright end-to-end checks, mocked Gateway WebSocket flows, mocked dashboard runs, screenshots/videos, or agent-verifiable browser proof.

community

obra/superpowers

Obra superpowers agent skills.

community

affaan-m/ECC

See, Understand, Act on video and audio. See- ingest from local files, URLs, RTSP/live feeds, or live record desktop; return realtime context and playable stream links. Understand- extract frames, build visual/semantic/temporal indexes, and search moments with timestamps and auto-clips. Act- transcode and normalize (codec, fps, resolution, aspect ratio), perform timeline edits (subtitles, text/image overlays, branding, audio overlays, dubbing, translation), generate media assets (image, audio...

community

affaan-m/everything-claude-code

End-to-end marketing campaign planning and execution. Covers audience research, positioning, campaign angle definition, landing page copy, email sequences, social posts, ad copy, short-form video scripts, and content calendars. Use as the orchestration layer for multi-channel product launches. Use when planning or executing a multi-channel product launch, or producing landing page, email, social, or ad copy.

community