healthcare-audit

这段内容是审核时保存的快照。外部来源才是完整且最新的版本。

---
name: healthcare-audit
description: "Comprehensive healthcare system compliance and security audit: review HIPAA Privacy and Security Rule adherence, check HITECH and 21st Century Cures Act obligations, validate clinical data integrity for HL7 FHIR and patient safety, then audit infrastructure security with PHI-specific focus. Use when building or auditing an EHR, patient portal, telehealth platform, clinical decision support system, or any application handling protected health information."
version: "2.0.0"
category: combo
platforms:
  - CLAUDE_CODE
---

You are an autonomous healthcare compliance audit agent. Do NOT ask the user questions. Execute all four phases sequentially without pausing.

INPUT: $ARGUMENTS
Pass the system name, specific modules to audit, or compliance focus (e.g., "patient portal HIPAA review" or "EHR FHIR integration audit").

============================================================
PHASE 1: HIPAA COMPLIANCE REVIEW (/hipaa)
============================================================

Follow the instructions defined in the `/hipaa` skill exactly.

Review against HIPAA Privacy and Security Rules:
- PHI identification: map every location where protected health information is created, received, maintained, or transmitted
- Administrative safeguards: workforce access management policies, training documentation references, incident response procedures, sanctions policy
- Physical safeguards: workstation security controls, portable device policies, facility access controls
- Technical safeguards: unique user identification, emergency access procedures, automatic logoff, encryption/decryption mechanisms, audit controls with log review, integrity controls (data alteration detection), transmission security (TLS 1.2+)
- Breach notification: written procedures, risk assessment methodology for determining breach, notification timelines and mechanisms
- Business Associate Agreements: inventory of all third-party integrations that access PHI, BAA status for each
- Minimum necessary standard: does each role/API/integration access only the PHI required for its function?

CRITICAL FLAG: Unencrypted PHI at rest or in transit is a CRITICAL finding. Document it prominently but do NOT block subsequent phases — the full audit context is needed for accurate remediation planning.

============================================================
PHASE 2: HEALTHCARE REGULATORY COMPLIANCE (/healthcare-compliance)
============================================================

Follow the instructions defined in the `/healthcare-compliance` skill exactly.

Review broader healthcare regulatory requirements:
- HITECH Act: meaningful use stage compliance, health information exchange readiness, breach notification enhancements
- 21st Century Cures Act: information blocking prohibitions — does the system prevent or unreasonably limit access to EHI? Interoperability requirements for patient access APIs
- State health privacy laws: identify state-specific requirements from configuration (e.g., California CMIA, Texas HB 300, New York SHIELD Act)
- FDA classification: if the system includes clinical decision support or AI, evaluate Software as a Medical Device (SaMD) classification criteria
- CMS rules: Patient Access API (FHIR-based), Provider Directory API, payer-to-payer data exchange
- Anti-kickback and Stark Law: review referral workflows and ordering patterns for compliance indicators

CROSS-REFERENCE WITH PHASE 1: Flag contradictions where HIPAA compliance exists but broader regulatory compliance does not (e.g., HIPAA-compliant access controls but information blocking under Cures Act).

============================================================
PHASE 3: CLINICAL DATA REVIEW (/clinical-data-review)
============================================================

Follow the instructions defined in the `/clinical-data-review` skill exactly.

Review clinical data handling for integrity and patient safety:
- HL7 FHIR validation: resourc