[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F78WZWPMXQ9K04XCSFZQB4":3,"skill-same:01M6F78WZWPMXQ9K04XCSFZQB4":83},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":32,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":6,"ownerHtmlUrl":67,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":68,"install":69,"resources":82},"01M6F78WZWPMXQ9K04XCSFZQB4","hipaa-compliance",null,"Implement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling healthcare data.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",13,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hipaa-compliance\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"compliance","hipaa","hipaa compliance","configure","2026","when","controls","critical","requirements","main","community","agent-skills","devops","use","process","Rules","github","healthcare","baa","phi","devops-security","data","license","framework","change","implement","security","2026-11-10 10:12:30",false,"---\nname: hipaa-compliance\ndescription: Implement HIPAA security and privacy rules. Configure PHI protections\n  and BAA requirements. Use when handling healthcare data.\ncategory: security\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# HIPAA Compliance\n\nImplement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).\n\n## When to Use\n\n- Building or operating systems that handle electronic Protected Health Information\n- Configuring cloud infrastructure for HIPAA-eligible workloads\n- Establishing Business Associate Agreements with vendors\n- Implementing technical safeguards for PHI protection\n- Preparing for HIPAA compliance audits or OCR investigations\n\nThis is a control-mapping aid, not a compliance determination. Establish covered-entity\u002Fbusiness-associate applicability and have qualified privacy\u002Fsecurity counsel verify current effective rules. Proposed rules are not effective requirements. AES-256, TLS versions, MFA, 15-minute sessions, CMKs and annual\u002Fquarterly schedules below are baseline design choices, not universal statutory prescriptions. Addressable does not mean optional without documented risk assessment. Never send PHI to an unapproved service.\n\n## HIPAA Rules and Safeguards\n\n```yaml\nsecurity_rule:\n  administrative_safeguards:\n    164.308_a_1: \"Security Management Process\"\n    actions:\n      - Conduct risk analysis (required)\n      - Implement risk management program (required)\n      - Apply sanction policy for violations (required)\n      - Review information system activity (required)\n\n    164.308_a_3: \"Workforce Security\"\n    actions:\n      - Authorization\u002Fsupervision procedures (addressable)\n      - Workforce clearance procedure (addressable)\n      - Termination procedures (addressable)\n\n    164.308_a_4: \"Information Access Management\"\n    actions:\n      - Access authorization policies (addressable)\n      - Access establishment and modification (addressable)\n      - Isolate healthcare clearinghouse functions (required)\n\n    164.308_a_5: \"Security Awareness and Training\"\n    actions:\n      - Security reminders (addressable)\n      - Protection from malicious software (addressable)\n      - Log-in monitoring (addressable)\n      - Password management (addressable)\n\n    164.308_a_6: \"Security Incident Procedures\"\n    actions:\n      - Response and reporting procedures (required)\n\n    164.308_a_7: \"Contingency Plan\"\n    actions:\n      - Data backup plan (required)\n      - Disaster recovery plan (required)\n      - Emergency mode operation plan (required)\n      - Testing and revision procedures (addressable)\n      - Applications and data criticality analysis (addressable)\n\n    164.308_a_8: \"Evaluation\"\n    actions:\n      - Periodic technical and nontechnical evaluation (required)\n\n  physical_safeguards:\n    164.310_a: \"Facility Access Controls\"\n    164.310_b: \"Workstation Use\"\n    164.310_c: \"Workstation Security\"\n    164.310_d: \"Device and Media Controls\"\n\n  technical_safeguards:\n    164.312_a: \"Access Control\"\n    actions:\n      - Unique user identification (required)\n      - Emergency access procedure (required)\n      - Automatic logoff (addressable)\n      - Encryption and decryption (addressable)\n\n    164.312_b: \"Audit Controls\"\n    actions:\n      - Implement hardware\u002Fsoftware\u002Fprocedural mechanisms to record and examine access (required)\n\n    164.312_c: \"Integrity\"\n    actions:\n      - Mechanism to authenticate ePHI (addressable)\n\n    164.312_d: \"Person or Entity Authentication\"\n    actions:\n      - Verify identity of person\u002Fentity seeking access (required)\n\n    164.312_e: \"Transmission Security\"\n    actions:\n      - Integrity controls (addressable)\n      - Encryption (addressable)\n\nprivacy_rule:\n  minimum_necessary: \"Limit PHI use, disclosure, and requests to minimum necessary\"\n  individual_rights: \"Access, amendment, accounting of disclosures, restrictions\"\n  notice_of_practices: \"Provide notice of privacy practices to individuals\"\n\nbreach_notification_rule:\n  individual_notification: \"Without unreasonable delay, no later than 60 calendar days after discovery, subject to applicable exceptions\"\n  hhs_notification: \"Fewer than 500 individuals: within 60 days after discovery year ends; 500+: without unreasonable delay and no later than 60 days\"\n  media_notification: \"More than 500 residents of a state\u002Fjurisdiction; without unreasonable delay, within 60 days\"\n```\n\n## Technical Safeguards Implementation Checklist\n\n```yaml\nencryption_requirements:\n  at_rest:\n    standard: AES-256\n    aws_services:\n      - [ ] RDS encryption enabled (KMS managed key)\n      - [ ] S3 bucket default encryption (SSE-KMS)\n      - [ ] EBS volume encryption enabled\n      - [ ] DynamoDB table encryption (KMS)\n      - [ ] ElastiCache encryption at rest enabled\n      - [ ] Redshift cluster encryption enabled\n      - [ ] EFS encryption enabled\n    azure_services:\n      - [ ] Azure SQL TDE enabled (customer-managed key)\n      - [ ] Storage Account encryption (CMK)\n      - [ ] Managed Disk encryption (SSE with CMK)\n      - [ ] Cosmos DB encryption at rest\n    gcp_services:\n      - [ ] Cloud SQL encryption (CMEK)\n      - [ ] Cloud Storage encryption (CMEK)\n      - [ ] BigQuery encryption (CMEK)\n      - [ ] Persistent Disk encryption (CMEK)\n\n  in_transit:\n    standard: TLS 1.2 or higher\n    checks:\n      - [ ] TLS 1.2+ enforced on all load balancers\n      - [ ] HTTP-to-HTTPS redirect enabled\n      - [ ] Internal service-to-service mTLS configured\n      - [ ] Database connections use SSL\u002FTLS\n      - [ ] API gateways enforce TLS minimum version\n      - [ ] Email encryption for PHI (S\u002FMIME or TLS)\n      - [ ] VPN or private connectivity for admin access\n\n  key_management:\n    - [ ] Customer-managed KMS keys for PHI data stores\n    - [ ] Key rotation enabled (annual minimum)\n    - [ ] Key access restricted to authorized roles only\n    - [ ] Key usage audited via CloudTrail \u002F audit logs\n    - [ ] Key deletion protection enabled\n\naccess_control:\n  unique_user_identification:\n    - [ ] Individual user accounts (no shared credentials)\n    - [ ] MFA enforced for all users accessing PHI systems\n    - [ ] Service accounts with unique identities and audited usage\n    - [ ] Federated identity with SSO (SAML\u002FOIDC)\n\n  role_based_access:\n    - [ ] Least privilege roles defined per job function\n    - [ ] PHI access restricted to need-to-know\n    - [ ] Separate roles for data access vs. administration\n    - [ ] Privileged access requires just-in-time approval\n\n  session_management:\n    - [ ] Automatic session timeout (15 minutes idle for workstations)\n    - [ ] Re-authentication for sensitive operations\n    - [ ] Concurrent session limits\n    - [ ] Session tokens secured (HttpOnly, Secure, SameSite)\n\n  emergency_access:\n    - [ ] Break-glass procedure documented and tested\n    - [ ] Emergency access credentials stored securely\n    - [ ] All emergency access usage audited and reviewed\n    - [ ] Emergency access automatically expires\n\naudit_controls:\n  logging_requirements:\n    - [ ] All PHI access logged (read, write, delete)\n    - [ ] User authentication events logged\n    - [ ] Administrative actions logged\n    - [ ] Failed access attempts logged\n    - [ ] Log integrity protection (hash chaining or WORM storage)\n    - [ ] Log retention set by applicable law, risk analysis and documented policy\n    - [ ] Regular log review process documented\n\n  monitoring:\n    - [ ] Real-time alerting on unauthorized PHI access attempts\n    - [ ] Anomaly detection for unusual data access patterns\n    - [ ] Privileged action monitoring\n    - [ ] Data export\u002Fdownload alerting\n```\n\n## AWS HIPAA-Eligible Architecture\n\nProvisioning examples incur cost and alter account state. Review account, region, names, eligible-service scope, BAA, KMS\u002Fnetwork prerequisites and rollback before an authorized change. A HIPAA tag or encryption flag does not establish compliance. `put-event-selectors` replaces existing selectors: read and merge the full desired configuration before applying it.\n\n```bash\n# Verify you are using only HIPAA-eligible AWS services\n# Reference: https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fhipaa-eligible-services-reference\u002F\n\n# Create a dedicated VPC for PHI workloads\naws ec2 create-vpc --cidr-block 10.100.0.0\u002F16 \\\n  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=phi-vpc},{Key=Compliance,Value=HIPAA}]'\n\n# Enable VPC flow logs for network auditing\naws ec2 create-flow-log \\\n  --resource-type VPC \\\n  --resource-ids vpc-XXXXXXXX \\\n  --traffic-type ALL \\\n  --log-destination-type cloud-watch-logs \\\n  --log-group-name \u002Fvpc\u002Fphi-flow-logs \\\n  --deliver-logs-permission-arn arn:aws:iam::123456789012:role\u002FVPCFlowLogsRole\n\n# Create encrypted RDS instance for PHI\naws rds create-db-instance \\\n  --db-instance-identifier phi-database \\\n  --db-instance-class db.r6g.large \\\n  --engine postgres \\\n  --master-username admin \\\n  --manage-master-user-password \\\n  --allocated-storage 100 \\\n  --storage-encrypted \\\n  --kms-key-id arn:aws:kms:us-east-1:123456789012:alias\u002Fphi-rds-key \\\n  --vpc-security-group-ids sg-XXXXXXXX \\\n  --db-subnet-group-name phi-subnet-group \\\n  --backup-retention-period 35 \\\n  --multi-az \\\n  --deletion-protection \\\n  --enable-cloudwatch-logs-exports '[\"postgresql\",\"upgrade\"]' \\\n  --tags Key=Compliance,Value=HIPAA Key=DataClassification,Value=PHI\n\n# Create S3 bucket with HIPAA controls\naws s3api create-bucket --bucket phi-data-bucket --region us-east-1\n\naws s3api put-bucket-encryption --bucket phi-data-bucket \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"aws:kms\", \"KMSMasterKeyID\": \"alias\u002Fphi-s3-key\"}, \"BucketKeyEnabled\": true}]\n  }'\n\naws s3api put-public-access-block --bucket phi-data-bucket \\\n  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true\n\naws s3api put-bucket-versioning --bucket phi-data-bucket \\\n  --versioning-configuration Status=Enabled\n\naws s3api put-bucket-logging --bucket phi-data-bucket \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"phi-access-logs\", \"TargetPrefix\": \"phi-data-bucket\u002F\"}}'\n\n# Enable CloudTrail data events for PHI buckets\naws cloudtrail put-event-selectors --trail-name hipaa-audit-trail \\\n  --advanced-event-selectors '[{\n    \"Name\": \"PHI-S3-DataEvents\",\n    \"FieldSelectors\": [\n      {\"Field\": \"eventCategory\", \"Equals\": [\"Data\"]},\n      {\"Field\": \"resources.type\", \"Equals\": [\"AWS::S3::Object\"]},\n      {\"Field\": \"resources.ARN\", \"StartsWith\": [\"arn:aws:s3:::phi-data-bucket\u002F\"]}\n    ]\n  }]'\n```\n\n## Business Associate Agreement Tracking\n\n```yaml\nbaa_tracking:\n  required_when:\n    - Vendor creates, receives, maintains, or transmits PHI on your behalf\n    - Subcontractor of a business associate handles PHI\n    - Cloud service provider stores or processes PHI\n\n  not_required_for:\n    - Conduit exception (postal service, ISP carrying encrypted data)\n    - Treatment providers sharing PHI for treatment purposes\n    - Plan sponsor receiving summary health information\n\n  baa_registry:\n    format:\n      vendor_name: \"\"\n      baa_execution_date: \"\"\n      baa_expiration_date: \"\"\n      phi_types_shared: []\n      services_provided: \"\"\n      subcontractors_identified: []\n      breach_notification_sla: \"hours\"\n      last_risk_assessment: \"\"\n      next_review_date: \"\"\n      status: \"active | pending | expired\"\n\n  cloud_provider_baas:\n    aws:\n      - Sign AWS BAA via AWS Artifact in the console\n      - Applies to all HIPAA-eligible services in the account\n      - Must restrict PHI to eligible services only\n    azure:\n      - Microsoft BAA is part of Online Services Terms\n      - Automatically applies when using qualifying services\n    gcp:\n      - Sign Google Cloud BAA via Google Workspace Admin or Cloud console\n      - Covers HIPAA-eligible GCP services\n\n  review_schedule:\n    - [ ] Annual review of all active BAAs\n    - [ ] Verify vendor compliance certifications are current\n    - [ ] Confirm subcontractor BAAs are in place\n    - [ ] Update BAA registry with any vendor changes\n    - [ ] Assess vendor security posture annually\n```\n\n## Risk Analysis Automation\n\nUse bounded, read-only evidence collection in the approved account and regions. A failed\u002Fdenied API call is **unknown**, never a passing control. For example:\n\n```bash\naws sts get-caller-identity\naws rds describe-db-instances --region us-east-1 \\\n  --query 'DBInstances[].{ID:DBInstanceIdentifier,Encrypted:StorageEncrypted}' --output json\naws cloudtrail get-trail-status --name hipaa-audit-trail --region us-east-1\n```\n\nRecord command exit status, account\u002Fregion, timestamp, resource inventory and coverage gaps before interpreting results. Validate IAM credential-report CSV by named headers with a real CSV parser; fixed field positions and lexicographic dates can misclassify keys. Poll report generation with a bounded deadline and inspect both keys, active state and last-used\u002Frotation fields separately. TLS listener presence does not prove TLS policy, backend encryption or PHI coverage; S3 encryption defaults do not prove every historical object\u002Fkey policy is adequate. Never label this scan a complete HIPAA risk analysis.\n\n\n## HIPAA Compliance Checklist\n\n```yaml\nhipaa_compliance_checklist:\n  administrative:\n    - [ ] Risk analysis conducted and documented\n    - [ ] Risk management plan implemented\n    - [ ] Security officer designated\n    - [ ] Privacy officer designated\n    - [ ] Workforce security awareness training completed\n    - [ ] Sanction policy documented and communicated\n    - [ ] Contingency plan (backup, DR, emergency mode) documented\n    - [ ] Business associate agreements signed for all applicable vendors\n    - [ ] Periodic evaluation\u002Faudit scheduled\n\n  technical:\n    - [ ] Unique user identification enforced\n    - [ ] MFA enabled for all PHI system access\n    - [ ] Automatic logoff configured (15-minute timeout)\n    - [ ] Encryption at rest (AES-256) for all PHI stores\n    - [ ] Encryption in transit (TLS 1.2+) for all PHI transmission\n    - [ ] Audit logging enabled for all PHI access\n    - [ ] Log retention justified and documented; required Security Rule documentation kept for six years from creation or last effective date, whichever is later\n    - [ ] Integrity controls on PHI (checksums, signatures)\n    - [ ] Emergency access (break-glass) procedure tested\n\n  physical:\n    - [ ] Facility access controls documented\n    - [ ] Workstation use policy in place\n    - [ ] Device and media disposal procedures documented\n    - [ ] Media re-use procedures documented\n\n  breach_response:\n    - [ ] Breach notification procedure documented\n    - [ ] Breach risk assessment methodology defined\n    - [ ] Individual notification template prepared\n    - [ ] HHS notification process understood\n    - [ ] Breach log maintained\n    - [ ] Annual breach assessment reviewed\n\n  operational:\n    - [ ] PHI data inventory maintained\n    - [ ] Minimum necessary access enforced\n    - [ ] Access reviews conducted quarterly\n    - [ ] Vendor risk assessments current\n    - [ ] Incident response plan tested annually\n    - [ ] Policies reviewed and updated annually\n```\n\n## Best Practices\n\n- Conduct a thorough risk analysis annually and after significant system changes\n- Use only HIPAA-eligible cloud services and sign BAAs before deploying PHI workloads\n- Encrypt all PHI at rest and in transit with no exceptions\n- Implement the minimum necessary standard: grant access only to the PHI needed for each role\n- Retain required Security Rule documentation for six years from creation or last effective date, whichever is later; determine audit-log retention separately\n- Train all workforce members on HIPAA policies at onboarding and annually\n- Test contingency plans (backup restore, DR failover, emergency access) at least annually\n- Track all Business Associate Agreements in a central registry with review dates\n- Document every addressable specification decision (implement, alternative, or not applicable with rationale)\n- Prepare breach notification templates and procedures before an incident occurs\n\n## Primary References\n\n- [HHS Security Rule summary](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fsecurity\u002Flaws-regulations\u002Findex.html)\n- [HHS encryption guidance](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Ffaq\u002Fis-the-use-of-encryption-mandatory-in-the-security-rule\u002Findex.html)\n- [HHS breach notification](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fbreach-notification\u002Findex.html)\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# HIPAA Compliance\n\nImplement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).\n\n## When to Use\n\n- Building or operating systems that handle electronic Protected Health Information\n- Configuring cloud infrastructure for HIPAA-eligible workloads\n- Establishing Business Associate Agreements with vendors\n- Implementing technical safeguards for PHI protection\n- Preparing for HIPAA compliance audits or OCR investigations\n\nThis is a control-mapping aid, not a compliance determination. Establish covered-entity\u002Fbusiness-associate applicability and have qualified privacy\u002Fsecurity counsel verify current effective rules. Proposed rules are not effective requirements. AES-256, TLS versions, MFA, 15-minute sessions, CMKs and annual\u002Fquarterly schedules below are baseline design choices, not universal statutory prescriptions. Addressable does not mean optional without documented risk assessment. Never send PHI to an unapproved service.\n\n## HIPAA Rules and Safeguards\n\n```yaml\nsecurity_rule:\n  administrative_safeguards:\n    164.308_a_1: \"Security Management Process\"\n    actions:\n      - Conduct risk analysis (required)\n      - Implement risk management program (required)\n      - Apply sanction policy for violations (required)\n      - Review information system activity (required)\n\n    164.308_a_3: \"Workforce Security\"\n    actions:\n      - Authorization\u002Fsupervision procedures (addressable)\n      - Workforce clearance procedure (addressable)\n      - Termination procedures (addressable)\n\n    164.308_a_4: \"Information Access Management\"\n    actions:\n      - Access authorization policies (addressable)\n      - Access establishment and modification (addressable)\n      - Isolate healthcare clearinghouse functions (required)\n\n    164.308_a_5: \"Security Awareness and Training\"\n    actions:\n      - Security reminders (addressable)\n      - Protection from malicious software (addressable)\n      - Log-in monitoring (addressable)\n      - Password management (addressable)\n\n    164.308_a_6: \"Security Incident Procedures\"\n    actions:\n      - Response and reporting procedures (required)\n\n    164.308_a_7: \"Contingency Plan\"\n    actions:\n      - Data backup plan (required)\n      - Disaster recovery plan (required)\n      - Emergency mode operation plan (required)\n      - Testing and revision procedures (addressable)\n      - Applications and data criticality analysis (addressable)\n\n    164.308_a_8: \"Evaluation\"\n    actions:\n      - Periodic technical and nontechnical evaluation (required)\n\n  physical_safeguards:\n    164.310_a: \"Facility Access Controls\"\n    164.310_b: \"Workstation Use\"\n    164.310_c: \"Workstation Security\"\n    164.310_d: \"Device and Media Controls\"\n\n  technical_safeguards:\n    164.312_a: \"Access Control\"\n    actions:\n      - Unique user identification (required)\n      - Emergency access procedure (required)\n      - Automatic logoff (addressable)\n      - Encryption and decryption (addressable)\n\n    164.312_b: \"Audit Controls\"\n    actions:\n      - Implement hardware\u002Fsoftware\u002Fprocedural mechanisms to record and examine access (required)\n\n    164.312_c: \"Integrity\"\n    actions:\n      - Mechanism to authenticate ePHI (addressable)\n\n    164.312_d: \"Person or Entity Authentication\"\n    actions:\n      - Verify identity of person\u002Fentity seeking access (required)\n\n    164.312_e: \"Transmission Security\"\n    actions:\n      - Integrity controls (addressable)\n      - Encryption (addressable)\n\nprivacy_rule:\n  minimum_necessary: \"Limit PHI use, disclosure, and requests to minimum necessary\"\n  individual_rights: \"Access, amendment, accounting of disclosures, restrictions\"\n  notice_of_practices: \"Provide notice of privacy practices to individuals\"\n\nbreach_notification_rule:\n  individual_notification: \"Without unreasonable delay, no later than 60 calendar days after discovery, subject to applicable exceptions\"\n  hhs_notification: \"Fewer than 500 individuals: within 60 days after discovery year ends; 500+: without unreasonable delay and no later than 60 days\"\n  media_notification: \"More than 500 residents of a state\u002Fjurisdiction; without unreasonable delay, within 60 days\"\n```\n\n## Technical Safeguards Implementation Checklist\n\n```yaml\nencryption_requirements:\n  at_rest:\n    standard: AES-256\n    aws_services:\n      - [ ] RDS encryption enabled (KMS managed key)\n      - [ ] S3 bucket default encryption (SSE-KMS)\n      - [ ] EBS volume encryption enabled\n      - [ ] DynamoDB table encryption (KMS)\n      - [ ] ElastiCache encryption at rest enabled\n      - [ ] Redshift cluster encryption enabled\n      - [ ] EFS encryption enabled\n    azure_services:\n      - [ ] Azure SQL TDE enabled (customer-managed key)\n      - [ ] Storage Account encryption (CMK)\n      - [ ] Managed Disk encryption (SSE with CMK)\n      - [ ] Cosmos DB encryption at rest\n    gcp_services:\n      - [ ] Cloud SQL encryption (CMEK)\n      - [ ] Cloud Storage encryption (CMEK)\n      - [ ] BigQuery encryption (CMEK)\n      - [ ] Persistent Disk encryption (CMEK)\n\n  in_transit:\n    standard: TLS 1.2 or higher\n    checks:\n      - [ ] TLS 1.2+ enforced on all load balancers\n      - [ ] HTTP-to-HTTPS redirect enabled\n      - [ ] Internal service-to-service mTLS configured\n      - [ ] Database connections use SSL\u002FTLS\n      - [ ] API gateways enforce TLS minimum version\n      - [ ] Email encryption for PHI (S\u002FMIME or TLS)\n      - [ ] VPN or private connectivity for admin access\n\n  key_management:\n    - [ ] Customer-managed KMS keys for PHI data stores\n    - [ ] Key rotation enabled (annual minimum)\n    - [ ] Key access restricted to authorized roles only\n    - [ ] Key usage audited via CloudTrail \u002F audit logs\n    - [ ] Key deletion protection enabled\n\naccess_control:\n  unique_user_identification:\n    - [ ] Individual user accounts (no shared credentials)\n    - [ ] MFA enforced for all users accessing PHI systems\n    - [ ] Service accounts with unique identities and audited usage\n    - [ ] Federated identity with SSO (SAML\u002FOIDC)\n\n  role_based_access:\n    - [ ] Least privilege roles defined per job function\n    - [ ] PHI access restricted to need-to-know\n    - [ ] Separate roles for data access vs. administration\n    - [ ] Privileged access requires just-in-time approval\n\n  session_management:\n    - [ ] Automatic session timeout (15 minutes idle for workstations)\n    - [ ] Re-authentication for sensitive operations\n    - [ ] Concurrent session limits\n    - [ ] Session tokens secured (HttpOnly, Secure, SameSite)\n\n  emergency_access:\n    - [ ] Break-glass procedure documented and tested\n    - [ ] Emergency access credentials stored securely\n    - [ ] All emergency access usage audited and reviewed\n    - [ ] Emergency access automatically expires\n\naudit_controls:\n  logging_requirements:\n    - [ ] All PHI access logged (read, write, delete)\n    - [ ] User authentication events logged\n    - [ ] Administrative actions logged\n    - [ ] Failed access attempts logged\n    - [ ] Log integrity protection (hash chaining or WORM storage)\n    - [ ] Log retention set by applicable law, risk analysis and documented policy\n    - [ ] Regular log review process documented\n\n  monitoring:\n    - [ ] Real-time alerting on unauthorized PHI access attempts\n    - [ ] Anomaly detection for unusual data access patterns\n    - [ ] Privileged action monitoring\n    - [ ] Data export\u002Fdownload alerting\n```\n\n## AWS HIPAA-Eligible Architecture\n\nProvisioning examples incur cost and alter account state. Review account, region, names, eligible-service scope, BAA, KMS\u002Fnetwork prerequisites and rollback before an authorized change. A HIPAA tag or encryption flag does not establish compliance. `put-event-selectors` replaces existing selectors: read and merge the full desired configuration before applying it.\n\n```bash\n# Verify you are using only HIPAA-eligible AWS services\n# Reference: https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fhipaa-eligible-services-reference\u002F\n\n# Create a dedicated VPC for PHI workloads\naws ec2 create-vpc --cidr-block 10.100.0.0\u002F16 \\\n  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=phi-vpc},{Key=Compliance,Value=HIPAA}]'\n\n# Enable VPC flow logs for network auditing\naws ec2 create-flow-log \\\n  --resource-type VPC \\\n  --resource-ids vpc-XXXXXXXX \\\n  --traffic-type ALL \\\n  --log-destination-type cloud-watch-logs \\\n  --log-group-name \u002Fvpc\u002Fphi-flow-logs \\\n  --deliver-logs-permission-arn arn:aws:iam::123456789012:role\u002FVPCFlowLogsRole\n\n# Create encrypted RDS instance for PHI\naws rds create-db-instance \\\n  --db-instance-identifier phi-database \\\n  --db-instance-class db.r6g.large \\\n  --engine postgres \\\n  --master-username admin \\\n  --manage-master-user-password \\\n  --allocated-storage 100 \\\n  --storage-encrypted \\\n  --kms-key-id arn:aws:kms:us-east-1:123456789012:alias\u002Fphi-rds-key \\\n  --vpc-security-group-ids sg-XXXXXXXX \\\n  --db-subnet-group-name phi-subnet-group \\\n  --backup-retention-period 35 \\\n  --multi-az \\\n  --deletion-protection \\\n  --enable-cloudwatch-logs-exports '[\"postgresql\",\"upgrade\"]' \\\n  --tags Key=Compliance,Value=HIPAA Key=DataClassification,Value=PHI\n\n# Create S3 bucket with HIPAA controls\naws s3api create-bucket --bucket phi-data-bucket --region us-east-1\n\naws s3api put-bucket-encryption --bucket phi-data-bucket \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"aws:kms\", \"KMSMasterKeyID\": \"alias\u002Fphi-s3-key\"}, \"BucketKeyEnabled\": true}]\n  }'\n\naws s3api put-public-access-block --bucket phi-data-bucket \\\n  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true\n\naws s3api put-bucket-versioning --bucket phi-data-bucket \\\n  --versioning-configuration Status=Enabled\n\naws s3api put-bucket-logging --bucket phi-data-bucket \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"phi-access-logs\", \"TargetPrefix\": \"phi-data-bucket\u002F\"}}'\n\n# Enable CloudTrail data events for PHI buckets\naws cloudtrail put-event-selectors --trail-name hipaa-audit-trail \\\n  --advanced-event-selectors '[{\n    \"Name\": \"PHI-S3-DataEvents\",\n    \"FieldSelectors\": [\n      {\"Field\": \"eventCategory\", \"Equals\": [\"Data\"]},\n      {\"Field\": \"resources.type\", \"Equals\": [\"AWS::S3::Object\"]},\n      {\"Field\": \"resources.ARN\", \"StartsWith\": [\"arn:aws:s3:::phi-data-bucket\u002F\"]}\n    ]\n  }]'\n```\n\n## Business Associate Agreement Tracking\n\n```yaml\nbaa_tracking:\n  required_when:\n    - Vendor creates, receives, maintains, or transmits PHI on your behalf\n    - Subcontractor of a business associate handles PHI\n    - Cloud service provider stores or processes PHI\n\n  not_required_for:\n    - Conduit exception (postal service, ISP carrying encrypted data)\n    - Treatment providers sharing PHI for treatment purposes\n    - Plan sponsor receiving summary health information\n\n  baa_registry:\n    format:\n      vendor_name: \"\"\n      baa_execution_date: \"\"\n      baa_expiration_date: \"\"\n      phi_types_shared: []\n      services_provided: \"\"\n      subcontractors_identified: []\n      breach_notification_sla: \"hours\"\n      last_risk_assessment: \"\"\n      next_review_date: \"\"\n      status: \"active | pending | expired\"\n\n  cloud_provider_baas:\n    aws:\n      - Sign AWS BAA via AWS Artifact in the console\n      - Applies to all HIPAA-eligible services in the account\n      - Must restrict PHI to eligible services only\n    azure:\n      - Microsoft BAA is part of Online Services Terms\n      - Automatically applies when using qualifying services\n    gcp:\n      - Sign Google Cloud BAA via Google Workspace Admin or Cloud console\n      - Covers HIPAA-eligible GCP services\n\n  review_schedule:\n    - [ ] Annual review of all active BAAs\n    - [ ] Verify vendor compliance certifications are current\n    - [ ] Confirm subcontractor BAAs are in place\n    - [ ] Update BAA registry with any vendor changes\n    - [ ] Assess vendor security posture annually\n```\n\n## Risk Analysis Automation\n\nUse bounded, read-only evidence collection in the approved account and regions. A failed\u002Fdenied API call is **unknown**, never a passing control. For example:\n\n```bash\naws sts get-caller-identity\naws rds describe-db-instances --region us-east-1 \\\n  --query 'DBInstances[].{ID:DBInstanceIdentifier,Encrypted:StorageEncrypted}' --output json\naws cloudtrail get-trail-status --name hipaa-audit-trail --region us-east-1\n```\n\nRecord command exit status, account\u002Fregion, timestamp, resource inventory and coverage gaps before interpreting results. Validate IAM credential-report CSV by named headers with a real CSV parser; fixed field positions and lexicographic dates can misclassify keys. Poll report generation with a bounded deadline and inspect both keys, active state and last-used\u002Frotation fields separately. TLS listener presence does not prove TLS policy, backend encryption or PHI coverage; S3 encryption defaults do not prove every historical object\u002Fkey policy is adequate. Never label this scan a complete HIPAA risk analysis.\n\n\n## HIPAA Compliance Checklist\n\n```yaml\nhipaa_compliance_checklist:\n  administrative:\n    - [ ] Risk analysis conducted and documented\n    - [ ] Risk management plan implemented\n    - [ ] Security officer designated\n    - [ ] Privacy officer designated\n    - [ ] Workforce security awareness training completed\n    - [ ] Sanction policy documented and communicated\n    - [ ] Contingency plan (backup, DR, emergency mode) documented\n    - [ ] Business associate agreements signed for all applicable vendors\n    - [ ] Periodic evaluation\u002Faudit scheduled\n\n  technical:\n    - [ ] Unique user identification enforced\n    - [ ] MFA enabled for all PHI system access\n    - [ ] Automatic logoff configured (15-minute timeout)\n    - [ ] Encryption at rest (AES-256) for all PHI stores\n    - [ ] Encryption in transit (TLS 1.2+) for all PHI transmission\n    - [ ] Audit logging enabled for all PHI access\n    - [ ] Log retention justified and documented; required Security Rule documentation kept for six years from creation or last effective date, whichever is later\n    - [ ] Integrity controls on PHI (checksums, signatures)\n    - [ ] Emergency access (break-glass) procedure tested\n\n  physical:\n    - [ ] Facility access controls documented\n    - [ ] Workstation use policy in place\n    - [ ] Device and media disposal procedures documented\n    - [ ] Media re-use procedures documented\n\n  breach_response:\n    - [ ] Breach notification procedure documented\n    - [ ] Breach risk assessment methodology defined\n    - [ ] Individual notification template prepared\n    - [ ] HHS notification process understood\n    - [ ] Breach log maintained\n    - [ ] Annual breach assessment reviewed\n\n  operational:\n    - [ ] PHI data inventory maintained\n    - [ ] Minimum necessary access enforced\n    - [ ] Access reviews conducted quarterly\n    - [ ] Vendor risk assessments current\n    - [ ] Incident response plan tested annually\n    - [ ] Policies reviewed and updated annually\n```\n\n## Best Practices\n\n- Conduct a thorough risk analysis annually and after significant system changes\n- Use only HIPAA-eligible cloud services and sign BAAs before deploying PHI workloads\n- Encrypt all PHI at rest and in transit with no exceptions\n- Implement the minimum necessary standard: grant access only to the PHI needed for each role\n- Retain required Security Rule documentation for six years from creation or last effective date, whichever is later; determine audit-log retention separately\n- Train all workforce members on HIPAA policies at onboarding and annually\n- Test contingency plans (backup restore, DR failover, emergency access) at least annually\n- Track all Business Associate Agreements in a central registry with review dates\n- Document every addressable specification decision (implement, alternative, or not applicable with rationale)\n- Prepare breach notification templates and procedures before an incident occurs\n\n## Primary References\n\n- [HHS Security Rule summary](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fsecurity\u002Flaws-regulations\u002Findex.html)\n- [HHS encryption guidance](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Ffaq\u002Fis-the-use-of-encryption-mandatory-in-the-security-rule\u002Findex.html)\n- [HHS breach notification](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fbreach-notification\u002Findex.html)\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":30,"source":55,"license":14,"category":49,"metadata":56,"date_added":59,"description":7,"source_repo":60,"source_type":33,"compatibility":61,"license_source":62},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":57,"version":58},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-hipaa-compliance",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-14 14:18:11",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add boisenoise\u002Fskills-collections --skill hipaa-compliance",{"tool":75,"command":76},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill hipaa-compliance",{"tool":78,"command":79},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill hipaa-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-hipaa-compliance\u002FSKILL.md",true,[],[84,110,135,159,178,201],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":88,"licenseFileUrl":89,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":50},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[93,94,95,96,97,98,99,44,100,101,102,103,104,105,106,30,107,108,109,28,27],"web","access","web access","official","development","browser","search","Tools","read","fetch","only","youtube","free tools","platform","free","cover","normal",{"skillNo":111,"name":112,"nameZh":6,"description":113,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":88,"licenseFileUrl":114,"sourceHtmlUrl":115,"categories":116,"keywords":122,"publishedAt":50},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[112,123,124,39,96,97,45,100,125,126,127,128,36,129,130,30,131,132,133,134,27],"MCP","cli","Budget","credentials","team","catalog","call","discover","external tools","with","scoped","blob",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":88,"licenseFileUrl":139,"sourceHtmlUrl":140,"categories":141,"keywords":145,"publishedAt":50},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[142],{"categoryNo":143,"categoryName":144,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000038","人力资源",[137,39,96,45,146,147,148,149,150,151,30,152,153,154,132,155,156,157,158,134,112,27],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":88,"licenseFileUrl":163,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":50},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[167,168,169,39,96,45,170,171,146,172,125,173,174,175,150,30,176,177,134,112,27],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":88,"licenseFileUrl":182,"sourceHtmlUrl":183,"categories":184,"keywords":185,"publishedAt":50},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[186,187,39,188,96,189,45,190,191,192,193,194,30,195,196,197,198,199,200,134],"make","make ugc","research","create","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":88,"licenseFileUrl":205,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":50},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[209,210,211,39,96,45,212,213,149,214,215,30,216,217,218,219,220,221,222,134],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]