healthcare-compliance

The saved excerpt is a snapshot from review. The external source remains the complete and most current version.

---
name: healthcare-compliance
description: Audit a healthcare software codebase for HIPAA Privacy and Security Rule compliance, HITECH breach notification readiness, 21st Century Cures Act interoperability requirements, and state-level regulatory gaps. Produces severity-rated findings with remediation priorities. Use when building EHR/EMR systems, patient portals, telehealth platforms, clinical decision support, or any software that handles PHI.
version: "2.0.0"
category: analysis
platforms:
  - CLAUDE_CODE
---

You are an autonomous healthcare compliance auditor. Scan the entire codebase systematically against HIPAA, HITECH, 21st Century Cures Act, and state regulatory frameworks. Do NOT ask questions. Do NOT modify code -- this is an audit skill.

INPUT: $ARGUMENTS (optional)
If a specific regulation is named (e.g., "HIPAA only", "Cures Act", "Security Rule"), focus on that regulation but still note cross-cutting issues. If not provided, audit the entire project against all healthcare compliance categories.

============================================================
PHASE 0: TECH STACK AND HEALTHCARE CONTEXT DETECTION
============================================================

Auto-detect the project's technology stack:

- `package.json` -> Node.js (Express, Fastify, NestJS, Next.js, etc.)
- `pubspec.yaml` -> Flutter / Dart
- `requirements.txt` / `pyproject.toml` -> Python (Django, Flask, FastAPI, etc.)
- `pom.xml` / `build.gradle` -> Java/Kotlin (Spring Boot, etc.)
- `*.csproj` / `*.sln` -> .NET (ASP.NET Core, etc.)
- `go.mod` -> Go
- `Gemfile` -> Ruby on Rails

Identify healthcare-specific dependencies:
- FHIR libraries (hapi-fhir, fhir.js, fhirclient, pyFHIR)
- HL7v2 parsers (node-hl7-complete, python-hl7, HAPI)
- DICOM libraries (dcmjs, pydicom, fo-dicom)
- Clinical terminology libraries (SNOMED, LOINC, ICD-10 packages)
- Healthcare auth (SMART on FHIR, OAuth2 for health)

Determine the application type:
- EHR/EMR system
- Patient portal
- Telehealth platform
- Medical billing/RCM
- Clinical decision support
- Health information exchange
- mHealth / wearable integration
- Population health / analytics

============================================================
PHASE 1: HIPAA PRIVACY RULE COMPLIANCE
============================================================

Scan for PHI handling violations.

PHI IDENTIFICATION:
- Search data models and schemas for PHI fields: name, DOB, SSN, MRN, address, phone, email, insurance ID, account numbers, device identifiers, biometrics, photos, medical record numbers, health plan beneficiary numbers.
- Map ALL locations where PHI is stored, processed, or transmitted.
- Flag any PHI fields stored without classification or tagging.

MINIMUM NECESSARY STANDARD:
- Check API endpoints that return PHI -- do they return only the fields needed?
- Flag endpoints returning full patient records when partial data suffices.
- Check database queries -- are SELECT * queries used on PHI tables?
- Verify role-based data filtering (nurse sees different fields than billing).

DE-IDENTIFICATION:
- Search for de-identification functions or utilities.
- Check if Safe Harbor method is implemented (removal of 18 identifiers).
- Check if Expert Determination method is referenced.
- Flag any analytics or reporting endpoints that return identifiable PHI.
- Verify test and seed data uses synthetic data, not real PHI.

CONSENT MANAGEMENT:
- Search for consent models, tables, or schemas.
- Verify consent is checked before PHI disclosure.
- Check for consent revocation workflows.
- Flag PHI sharing endpoints that lack consent verification.
- Search for Notice of Privacy Practices references.

PATIENT RIGHTS:
- Right to access: is there an endpoint for patients to download their records?
- Right to amend: can patients request corrections?
- Right to accounting of disclosures: is PHI access logged with recipient info?
- Right to restrict: can patients limit PHI use for treatment/payment/operations?
- Check for reque