[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P5AD3VDV1MNK8V2NFKY09H":3,"skill-same:01M6P5AD3VDV1MNK8V2NFKY09H":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":30,"commitSha":58,"skillDirectory":59,"forksCount":13,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":62,"install":63,"resources":76},"01M6P5AD3VDV1MNK8V2NFKY09H","hipaa-compliance",null,"Implement HIPAA security and privacy rules. Configure PHI protections and BAA requirements. Use when handling healthcare data.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhipaa-compliance\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"compliance","hipaa","hipaa compliance","process","apply","controls","requirements","main","community","agent-skills","devops","use","github","Rules","configure","healthcare","devops-security","license","change","implement","2026-11-10 10:12:30",false,"---\nname: hipaa-compliance\ndescription: Implement HIPAA security and privacy rules. Configure PHI protections\n  and BAA requirements. Use when handling healthcare data.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# HIPAA Compliance\n\nImplement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).\n\n## When to Use\n\n- Building or operating systems that handle electronic Protected Health Information\n- Configuring cloud infrastructure for HIPAA-eligible workloads\n- Establishing Business Associate Agreements with vendors\n- Implementing technical safeguards for PHI protection\n- Preparing for HIPAA compliance audits or OCR investigations\n\n## HIPAA Rules and Safeguards\n\n```yaml\nsecurity_rule:\n  administrative_safeguards:\n    164.308_a_1: \"Security Management Process\"\n    actions:\n      - Conduct risk analysis (required)\n      - Implement risk management program (required)\n      - Apply sanction policy for violations (required)\n      - Review information system activity (required)\n\n    164.308_a_3: \"Workforce Security\"\n    actions:\n      - Authorization\u002Fsupervision procedures (addressable)\n      - Workforce clearance procedure (addressable)\n      - Termination procedures (addressable)\n\n    164.308_a_4: \"Information Access Management\"\n    actions:\n      - Access authorization policies (addressable)\n      - Access establishment and modification (addressable)\n      - Isolate healthcare clearinghouse functions (required)\n\n    164.308_a_5: \"Security Awareness and Training\"\n    actions:\n      - Security reminders (addressable)\n      - Protection from malicious software (addressable)\n      - Log-in monitoring (addressable)\n      - Password management (addressable)\n\n    164.308_a_6: \"Security Incident Procedures\"\n    actions:\n      - Response and reporting procedures (required)\n\n    164.308_a_7: \"Contingency Plan\"\n    actions:\n      - Data backup plan (required)\n      - Disaster recovery plan (required)\n      - Emergency mode operation plan (required)\n      - Testing and revision procedures (addressable)\n      - Applications and data criticality analysis (addressable)\n\n    164.308_a_8: \"Evaluation\"\n    actions:\n      - Periodic technical and nontechnical evaluation (required)\n\n  physical_safeguards:\n    164.310_a: \"Facility Access Controls\"\n    164.310_b: \"Workstation Use\"\n    164.310_c: \"Workstation Security\"\n    164.310_d: \"Device and Media Controls\"\n\n  technical_safeguards:\n    164.312_a: \"Access Control\"\n    actions:\n      - Unique user identification (required)\n      - Emergency access procedure (required)\n      - Automatic logoff (addressable)\n      - Encryption and decryption (addressable)\n\n    164.312_b: \"Audit Controls\"\n    actions:\n      - Implement hardware\u002Fsoftware\u002Fprocedural mechanisms to record and examine access (required)\n\n    164.312_c: \"Integrity\"\n    actions:\n      - Mechanism to authenticate ePHI (addressable)\n\n    164.312_d: \"Person or Entity Authentication\"\n    actions:\n      - Verify identity of person\u002Fentity seeking access (required)\n\n    164.312_e: \"Transmission Security\"\n    actions:\n      - Integrity controls (addressable)\n      - Encryption (addressable)\n\nprivacy_rule:\n  minimum_necessary: \"Limit PHI use, disclosure, and requests to minimum necessary\"\n  individual_rights: \"Access, amendment, accounting of disclosures, restrictions\"\n  notice_of_practices: \"Provide notice of privacy practices to individuals\"\n\nbreach_notification_rule:\n  individual_notification: \"Within 60 days of discovery\"\n  hhs_notification: \"Annual for \u003C500 records; within 60 days for 500+\"\n  media_notification: \"Required when 500+ individuals in a state\u002Fjurisdiction\"\n```\n\n## Technical Safeguards Implementation Checklist\n\n```yaml\nencryption_requirements:\n  at_rest:\n    standard: AES-256\n    aws_services:\n      - [ ] RDS encryption enabled (KMS managed key)\n      - [ ] S3 bucket default encryption (SSE-KMS)\n      - [ ] EBS volume encryption enabled\n      - [ ] DynamoDB table encryption (KMS)\n      - [ ] ElastiCache encryption at rest enabled\n      - [ ] Redshift cluster encryption enabled\n      - [ ] EFS encryption enabled\n    azure_services:\n      - [ ] Azure SQL TDE enabled (customer-managed key)\n      - [ ] Storage Account encryption (CMK)\n      - [ ] Managed Disk encryption (SSE with CMK)\n      - [ ] Cosmos DB encryption at rest\n    gcp_services:\n      - [ ] Cloud SQL encryption (CMEK)\n      - [ ] Cloud Storage encryption (CMEK)\n      - [ ] BigQuery encryption (CMEK)\n      - [ ] Persistent Disk encryption (CMEK)\n\n  in_transit:\n    standard: TLS 1.2 or higher\n    checks:\n      - [ ] TLS 1.2+ enforced on all load balancers\n      - [ ] HTTP-to-HTTPS redirect enabled\n      - [ ] Internal service-to-service mTLS configured\n      - [ ] Database connections use SSL\u002FTLS\n      - [ ] API gateways enforce TLS minimum version\n      - [ ] Email encryption for PHI (S\u002FMIME or TLS)\n      - [ ] VPN or private connectivity for admin access\n\n  key_management:\n    - [ ] Customer-managed KMS keys for PHI data stores\n    - [ ] Key rotation enabled (annual minimum)\n    - [ ] Key access restricted to authorized roles only\n    - [ ] Key usage audited via CloudTrail \u002F audit logs\n    - [ ] Key deletion protection enabled\n\naccess_control:\n  unique_user_identification:\n    - [ ] Individual user accounts (no shared credentials)\n    - [ ] MFA enforced for all users accessing PHI systems\n    - [ ] Service accounts with unique identities and audited usage\n    - [ ] Federated identity with SSO (SAML\u002FOIDC)\n\n  role_based_access:\n    - [ ] Least privilege roles defined per job function\n    - [ ] PHI access restricted to need-to-know\n    - [ ] Separate roles for data access vs. administration\n    - [ ] Privileged access requires just-in-time approval\n\n  session_management:\n    - [ ] Automatic session timeout (15 minutes idle for workstations)\n    - [ ] Re-authentication for sensitive operations\n    - [ ] Concurrent session limits\n    - [ ] Session tokens secured (HttpOnly, Secure, SameSite)\n\n  emergency_access:\n    - [ ] Break-glass procedure documented and tested\n    - [ ] Emergency access credentials stored securely\n    - [ ] All emergency access usage audited and reviewed\n    - [ ] Emergency access automatically expires\n\naudit_controls:\n  logging_requirements:\n    - [ ] All PHI access logged (read, write, delete)\n    - [ ] User authentication events logged\n    - [ ] Administrative actions logged\n    - [ ] Failed access attempts logged\n    - [ ] Log integrity protection (hash chaining or WORM storage)\n    - [ ] Logs retained for minimum 6 years\n    - [ ] Regular log review process documented\n\n  monitoring:\n    - [ ] Real-time alerting on unauthorized PHI access attempts\n    - [ ] Anomaly detection for unusual data access patterns\n    - [ ] Privileged action monitoring\n    - [ ] Data export\u002Fdownload alerting\n```\n\n## AWS HIPAA-Eligible Architecture\n\n```bash\n# Verify you are using only HIPAA-eligible AWS services\n# Reference: https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fhipaa-eligible-services-reference\u002F\n\n# Create a dedicated VPC for PHI workloads\naws ec2 create-vpc --cidr-block 10.100.0.0\u002F16 \\\n  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=phi-vpc},{Key=Compliance,Value=HIPAA}]'\n\n# Enable VPC flow logs for network auditing\naws ec2 create-flow-log \\\n  --resource-type VPC \\\n  --resource-ids vpc-XXXXXXXX \\\n  --traffic-type ALL \\\n  --log-destination-type cloud-watch-logs \\\n  --log-group-name \u002Fvpc\u002Fphi-flow-logs \\\n  --deliver-logs-permission-arn arn:aws:iam::123456789012:role\u002FVPCFlowLogsRole\n\n# Create encrypted RDS instance for PHI\naws rds create-db-instance \\\n  --db-instance-identifier phi-database \\\n  --db-instance-class db.r6g.large \\\n  --engine postgres \\\n  --master-username admin \\\n  --master-user-password \"USE_SECRETS_MANAGER\" \\\n  --storage-encrypted \\\n  --kms-key-id arn:aws:kms:us-east-1:123456789012:alias\u002Fphi-rds-key \\\n  --vpc-security-group-ids sg-XXXXXXXX \\\n  --db-subnet-group-name phi-subnet-group \\\n  --backup-retention-period 35 \\\n  --multi-az \\\n  --deletion-protection \\\n  --enable-cloudwatch-logs-exports '[\"postgresql\",\"upgrade\"]' \\\n  --tags Key=Compliance,Value=HIPAA Key=DataClassification,Value=PHI\n\n# Create S3 bucket with HIPAA controls\naws s3api create-bucket --bucket phi-data-bucket --region us-east-1\n\naws s3api put-bucket-encryption --bucket phi-data-bucket \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"aws:kms\", \"KMSMasterKeyID\": \"alias\u002Fphi-s3-key\"}, \"BucketKeyEnabled\": true}]\n  }'\n\naws s3api put-public-access-block --bucket phi-data-bucket \\\n  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true\n\naws s3api put-bucket-versioning --bucket phi-data-bucket \\\n  --versioning-configuration Status=Enabled\n\naws s3api put-bucket-logging --bucket phi-data-bucket \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"phi-access-logs\", \"TargetPrefix\": \"phi-data-bucket\u002F\"}}'\n\n# Enable CloudTrail data events for PHI buckets\naws cloudtrail put-event-selectors --trail-name hipaa-audit-trail \\\n  --advanced-event-selectors '[{\n    \"Name\": \"PHI-S3-DataEvents\",\n    \"FieldSelectors\": [\n      {\"Field\": \"eventCategory\", \"Equals\": [\"Data\"]},\n      {\"Field\": \"resources.type\", \"Equals\": [\"AWS::S3::Object\"]},\n      {\"Field\": \"resources.ARN\", \"StartsWith\": [\"arn:aws:s3:::phi-data-bucket\u002F\"]}\n    ]\n  }]'\n```\n\n## Business Associate Agreement Tracking\n\n```yaml\nbaa_tracking:\n  required_when:\n    - Vendor creates, receives, maintains, or transmits PHI on your behalf\n    - Subcontractor of a business associate handles PHI\n    - Cloud service provider stores or processes PHI\n\n  not_required_for:\n    - Conduit exception (postal service, ISP carrying encrypted data)\n    - Treatment providers sharing PHI for treatment purposes\n    - Plan sponsor receiving summary health information\n\n  baa_registry:\n    format:\n      vendor_name: \"\"\n      baa_execution_date: \"\"\n      baa_expiration_date: \"\"\n      phi_types_shared: []\n      services_provided: \"\"\n      subcontractors_identified: []\n      breach_notification_sla: \"hours\"\n      last_risk_assessment: \"\"\n      next_review_date: \"\"\n      status: \"active | pending | expired\"\n\n  cloud_provider_baas:\n    aws:\n      - Sign AWS BAA via AWS Artifact in the console\n      - Applies to all HIPAA-eligible services in the account\n      - Must restrict PHI to eligible services only\n    azure:\n      - Microsoft BAA is part of Online Services Terms\n      - Automatically applies when using qualifying services\n    gcp:\n      - Sign Google Cloud BAA via Google Workspace Admin or Cloud console\n      - Covers HIPAA-eligible GCP services\n\n  review_schedule:\n    - [ ] Annual review of all active BAAs\n    - [ ] Verify vendor compliance certifications are current\n    - [ ] Confirm subcontractor BAAs are in place\n    - [ ] Update BAA registry with any vendor changes\n    - [ ] Assess vendor security posture annually\n```\n\n## Risk Analysis Automation\n\n```bash\n#!\u002Fusr\u002Fbin\u002Fenv bash\n# hipaa-risk-scan.sh - Technical risk analysis checks for HIPAA\n\necho \"=== HIPAA Technical Safeguard Checks ===\"\n\necho \"--- Encryption at Rest ---\"\n# Check for unencrypted RDS instances\nUNENCRYPTED_RDS=$(aws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' --output text)\n[ -z \"$UNENCRYPTED_RDS\" ] && echo \"PASS: All RDS instances encrypted\" || \\\n  echo \"FAIL: Unencrypted RDS: $UNENCRYPTED_RDS\"\n\n# Check for unencrypted S3 buckets\nfor bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do\n  enc=$(aws s3api get-bucket-encryption --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  [ -z \"$enc\" ] && echo \"FAIL: S3 bucket $bucket has no default encryption\"\ndone\n\n# Check for unencrypted EBS volumes\nUNENCRYPTED_EBS=$(aws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].VolumeId' --output text)\n[ -z \"$UNENCRYPTED_EBS\" ] && echo \"PASS: All EBS volumes encrypted\" || \\\n  echo \"FAIL: Unencrypted EBS: $UNENCRYPTED_EBS\"\n\necho \"--- Access Control ---\"\n# Check for users without MFA\naws iam generate-credential-report > \u002Fdev\u002Fnull 2>&1 && sleep 5\naws iam get-credential-report --output text --query Content | base64 -d | \\ \u003C!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->\n  awk -F, '$4==\"true\" && $8==\"false\" {print \"FAIL: User without MFA: \"$1}'\n\n# Check for unused access keys (90+ days)\nTHRESHOLD=$(date -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>\u002Fdev\u002Fnull || date -v-90d +%Y-%m-%dT%H:%M:%S)\naws iam get-credential-report --output text --query Content | base64 -d | \\ \u003C!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->\n  awk -F, -v t=\"$THRESHOLD\" 'NR>1 && $11!=\"N\u002FA\" && $11\u003Ct {print \"WARN: Stale access key for \"$1}'\n\necho \"--- Audit Controls ---\"\n# Verify CloudTrail is logging\nCT_STATUS=$(aws cloudtrail get-trail-status --name hipaa-audit-trail --query 'IsLogging' --output text)\n[ \"$CT_STATUS\" = \"True\" ] && echo \"PASS: CloudTrail active\" || echo \"FAIL: CloudTrail not logging\"\n\n# Verify VPC flow logs\nfor vpc in $(aws ec2 describe-vpcs --query 'Vpcs[*].VpcId' --output text); do\n  fl=$(aws ec2 describe-flow-logs --filter \"Name=resource-id,Values=$vpc\" --query 'FlowLogs[0].FlowLogId' --output text)\n  [ \"$fl\" = \"None\" ] && echo \"FAIL: No flow logs for VPC $vpc\"\ndone\n\necho \"--- Transmission Security ---\"\n# Check for ALBs without HTTPS listener\nfor alb in $(aws elbv2 describe-load-balancers --query 'LoadBalancers[*].LoadBalancerArn' --output text); do\n  HTTPS=$(aws elbv2 describe-listeners --load-balancer-arn \"$alb\" \\\n    --query 'Listeners[?Protocol==`HTTPS`].ListenerArn' --output text)\n  [ -z \"$HTTPS\" ] && echo \"FAIL: ALB without HTTPS: $alb\"\ndone\n\necho \"=== Scan complete ===\"\n```\n\n## HIPAA Compliance Checklist\n\n```yaml\nhipaa_compliance_checklist:\n  administrative:\n    - [ ] Risk analysis conducted and documented\n    - [ ] Risk management plan implemented\n    - [ ] Security officer designated\n    - [ ] Privacy officer designated\n    - [ ] Workforce security awareness training completed\n    - [ ] Sanction policy documented and communicated\n    - [ ] Contingency plan (backup, DR, emergency mode) documented\n    - [ ] Business associate agreements signed for all applicable vendors\n    - [ ] Periodic evaluation\u002Faudit scheduled\n\n  technical:\n    - [ ] Unique user identification enforced\n    - [ ] MFA enabled for all PHI system access\n    - [ ] Automatic logoff configured (15-minute timeout)\n    - [ ] Encryption at rest (AES-256) for all PHI stores\n    - [ ] Encryption in transit (TLS 1.2+) for all PHI transmission\n    - [ ] Audit logging enabled for all PHI access\n    - [ ] Log retention configured for 6+ years\n    - [ ] Integrity controls on PHI (checksums, signatures)\n    - [ ] Emergency access (break-glass) procedure tested\n\n  physical:\n    - [ ] Facility access controls documented\n    - [ ] Workstation use policy in place\n    - [ ] Device and media disposal procedures documented\n    - [ ] Media re-use procedures documented\n\n  breach_response:\n    - [ ] Breach notification procedure documented\n    - [ ] Breach risk assessment methodology defined\n    - [ ] Individual notification template prepared\n    - [ ] HHS notification process understood\n    - [ ] Breach log maintained\n    - [ ] Annual breach assessment reviewed\n\n  operational:\n    - [ ] PHI data inventory maintained\n    - [ ] Minimum necessary access enforced\n    - [ ] Access reviews conducted quarterly\n    - [ ] Vendor risk assessments current\n    - [ ] Incident response plan tested annually\n    - [ ] Policies reviewed and updated annually\n```\n\n## Best Practices\n\n- Conduct a thorough risk analysis annually and after significant system changes\n- Use only HIPAA-eligible cloud services and sign BAAs before deploying PHI workloads\n- Encrypt all PHI at rest and in transit with no exceptions\n- Implement the minimum necessary standard: grant access only to the PHI needed for each role\n- Maintain audit logs of all PHI access for a minimum of 6 years\n- Train all workforce members on HIPAA policies at onboarding and annually\n- Test contingency plans (backup restore, DR failover, emergency access) at least annually\n- Track all Business Associate Agreements in a central registry with review dates\n- Document every addressable specification decision (implement, alternative, or not applicable with rationale)\n- Prepare breach notification templates and procedures before an incident occurs\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# HIPAA Compliance\n\nImplement HIPAA Security Rule, Privacy Rule, and Breach Notification Rule requirements for systems that create, receive, maintain, or transmit electronic Protected Health Information (ePHI).\n\n## When to Use\n\n- Building or operating systems that handle electronic Protected Health Information\n- Configuring cloud infrastructure for HIPAA-eligible workloads\n- Establishing Business Associate Agreements with vendors\n- Implementing technical safeguards for PHI protection\n- Preparing for HIPAA compliance audits or OCR investigations\n\n## HIPAA Rules and Safeguards\n\n```yaml\nsecurity_rule:\n  administrative_safeguards:\n    164.308_a_1: \"Security Management Process\"\n    actions:\n      - Conduct risk analysis (required)\n      - Implement risk management program (required)\n      - Apply sanction policy for violations (required)\n      - Review information system activity (required)\n\n    164.308_a_3: \"Workforce Security\"\n    actions:\n      - Authorization\u002Fsupervision procedures (addressable)\n      - Workforce clearance procedure (addressable)\n      - Termination procedures (addressable)\n\n    164.308_a_4: \"Information Access Management\"\n    actions:\n      - Access authorization policies (addressable)\n      - Access establishment and modification (addressable)\n      - Isolate healthcare clearinghouse functions (required)\n\n    164.308_a_5: \"Security Awareness and Training\"\n    actions:\n      - Security reminders (addressable)\n      - Protection from malicious software (addressable)\n      - Log-in monitoring (addressable)\n      - Password management (addressable)\n\n    164.308_a_6: \"Security Incident Procedures\"\n    actions:\n      - Response and reporting procedures (required)\n\n    164.308_a_7: \"Contingency Plan\"\n    actions:\n      - Data backup plan (required)\n      - Disaster recovery plan (required)\n      - Emergency mode operation plan (required)\n      - Testing and revision procedures (addressable)\n      - Applications and data criticality analysis (addressable)\n\n    164.308_a_8: \"Evaluation\"\n    actions:\n      - Periodic technical and nontechnical evaluation (required)\n\n  physical_safeguards:\n    164.310_a: \"Facility Access Controls\"\n    164.310_b: \"Workstation Use\"\n    164.310_c: \"Workstation Security\"\n    164.310_d: \"Device and Media Controls\"\n\n  technical_safeguards:\n    164.312_a: \"Access Control\"\n    actions:\n      - Unique user identification (required)\n      - Emergency access procedure (required)\n      - Automatic logoff (addressable)\n      - Encryption and decryption (addressable)\n\n    164.312_b: \"Audit Controls\"\n    actions:\n      - Implement hardware\u002Fsoftware\u002Fprocedural mechanisms to record and examine access (required)\n\n    164.312_c: \"Integrity\"\n    actions:\n      - Mechanism to authenticate ePHI (addressable)\n\n    164.312_d: \"Person or Entity Authentication\"\n    actions:\n      - Verify identity of person\u002Fentity seeking access (required)\n\n    164.312_e: \"Transmission Security\"\n    actions:\n      - Integrity controls (addressable)\n      - Encryption (addressable)\n\nprivacy_rule:\n  minimum_necessary: \"Limit PHI use, disclosure, and requests to minimum necessary\"\n  individual_rights: \"Access, amendment, accounting of disclosures, restrictions\"\n  notice_of_practices: \"Provide notice of privacy practices to individuals\"\n\nbreach_notification_rule:\n  individual_notification: \"Within 60 days of discovery\"\n  hhs_notification: \"Annual for \u003C500 records; within 60 days for 500+\"\n  media_notification: \"Required when 500+ individuals in a state\u002Fjurisdiction\"\n```\n\n## Technical Safeguards Implementation Checklist\n\n```yaml\nencryption_requirements:\n  at_rest:\n    standard: AES-256\n    aws_services:\n      - [ ] RDS encryption enabled (KMS managed key)\n      - [ ] S3 bucket default encryption (SSE-KMS)\n      - [ ] EBS volume encryption enabled\n      - [ ] DynamoDB table encryption (KMS)\n      - [ ] ElastiCache encryption at rest enabled\n      - [ ] Redshift cluster encryption enabled\n      - [ ] EFS encryption enabled\n    azure_services:\n      - [ ] Azure SQL TDE enabled (customer-managed key)\n      - [ ] Storage Account encryption (CMK)\n      - [ ] Managed Disk encryption (SSE with CMK)\n      - [ ] Cosmos DB encryption at rest\n    gcp_services:\n      - [ ] Cloud SQL encryption (CMEK)\n      - [ ] Cloud Storage encryption (CMEK)\n      - [ ] BigQuery encryption (CMEK)\n      - [ ] Persistent Disk encryption (CMEK)\n\n  in_transit:\n    standard: TLS 1.2 or higher\n    checks:\n      - [ ] TLS 1.2+ enforced on all load balancers\n      - [ ] HTTP-to-HTTPS redirect enabled\n      - [ ] Internal service-to-service mTLS configured\n      - [ ] Database connections use SSL\u002FTLS\n      - [ ] API gateways enforce TLS minimum version\n      - [ ] Email encryption for PHI (S\u002FMIME or TLS)\n      - [ ] VPN or private connectivity for admin access\n\n  key_management:\n    - [ ] Customer-managed KMS keys for PHI data stores\n    - [ ] Key rotation enabled (annual minimum)\n    - [ ] Key access restricted to authorized roles only\n    - [ ] Key usage audited via CloudTrail \u002F audit logs\n    - [ ] Key deletion protection enabled\n\naccess_control:\n  unique_user_identification:\n    - [ ] Individual user accounts (no shared credentials)\n    - [ ] MFA enforced for all users accessing PHI systems\n    - [ ] Service accounts with unique identities and audited usage\n    - [ ] Federated identity with SSO (SAML\u002FOIDC)\n\n  role_based_access:\n    - [ ] Least privilege roles defined per job function\n    - [ ] PHI access restricted to need-to-know\n    - [ ] Separate roles for data access vs. administration\n    - [ ] Privileged access requires just-in-time approval\n\n  session_management:\n    - [ ] Automatic session timeout (15 minutes idle for workstations)\n    - [ ] Re-authentication for sensitive operations\n    - [ ] Concurrent session limits\n    - [ ] Session tokens secured (HttpOnly, Secure, SameSite)\n\n  emergency_access:\n    - [ ] Break-glass procedure documented and tested\n    - [ ] Emergency access credentials stored securely\n    - [ ] All emergency access usage audited and reviewed\n    - [ ] Emergency access automatically expires\n\naudit_controls:\n  logging_requirements:\n    - [ ] All PHI access logged (read, write, delete)\n    - [ ] User authentication events logged\n    - [ ] Administrative actions logged\n    - [ ] Failed access attempts logged\n    - [ ] Log integrity protection (hash chaining or WORM storage)\n    - [ ] Logs retained for minimum 6 years\n    - [ ] Regular log review process documented\n\n  monitoring:\n    - [ ] Real-time alerting on unauthorized PHI access attempts\n    - [ ] Anomaly detection for unusual data access patterns\n    - [ ] Privileged action monitoring\n    - [ ] Data export\u002Fdownload alerting\n```\n\n## AWS HIPAA-Eligible Architecture\n\n```bash\n# Verify you are using only HIPAA-eligible AWS services\n# Reference: https:\u002F\u002Faws.amazon.com\u002Fcompliance\u002Fhipaa-eligible-services-reference\u002F\n\n# Create a dedicated VPC for PHI workloads\naws ec2 create-vpc --cidr-block 10.100.0.0\u002F16 \\\n  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=phi-vpc},{Key=Compliance,Value=HIPAA}]'\n\n# Enable VPC flow logs for network auditing\naws ec2 create-flow-log \\\n  --resource-type VPC \\\n  --resource-ids vpc-XXXXXXXX \\\n  --traffic-type ALL \\\n  --log-destination-type cloud-watch-logs \\\n  --log-group-name \u002Fvpc\u002Fphi-flow-logs \\\n  --deliver-logs-permission-arn arn:aws:iam::123456789012:role\u002FVPCFlowLogsRole\n\n# Create encrypted RDS instance for PHI\naws rds create-db-instance \\\n  --db-instance-identifier phi-database \\\n  --db-instance-class db.r6g.large \\\n  --engine postgres \\\n  --master-username admin \\\n  --master-user-password \"USE_SECRETS_MANAGER\" \\\n  --storage-encrypted \\\n  --kms-key-id arn:aws:kms:us-east-1:123456789012:alias\u002Fphi-rds-key \\\n  --vpc-security-group-ids sg-XXXXXXXX \\\n  --db-subnet-group-name phi-subnet-group \\\n  --backup-retention-period 35 \\\n  --multi-az \\\n  --deletion-protection \\\n  --enable-cloudwatch-logs-exports '[\"postgresql\",\"upgrade\"]' \\\n  --tags Key=Compliance,Value=HIPAA Key=DataClassification,Value=PHI\n\n# Create S3 bucket with HIPAA controls\naws s3api create-bucket --bucket phi-data-bucket --region us-east-1\n\naws s3api put-bucket-encryption --bucket phi-data-bucket \\\n  --server-side-encryption-configuration '{\n    \"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"aws:kms\", \"KMSMasterKeyID\": \"alias\u002Fphi-s3-key\"}, \"BucketKeyEnabled\": true}]\n  }'\n\naws s3api put-public-access-block --bucket phi-data-bucket \\\n  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true\n\naws s3api put-bucket-versioning --bucket phi-data-bucket \\\n  --versioning-configuration Status=Enabled\n\naws s3api put-bucket-logging --bucket phi-data-bucket \\\n  --bucket-logging-status '{\"LoggingEnabled\": {\"TargetBucket\": \"phi-access-logs\", \"TargetPrefix\": \"phi-data-bucket\u002F\"}}'\n\n# Enable CloudTrail data events for PHI buckets\naws cloudtrail put-event-selectors --trail-name hipaa-audit-trail \\\n  --advanced-event-selectors '[{\n    \"Name\": \"PHI-S3-DataEvents\",\n    \"FieldSelectors\": [\n      {\"Field\": \"eventCategory\", \"Equals\": [\"Data\"]},\n      {\"Field\": \"resources.type\", \"Equals\": [\"AWS::S3::Object\"]},\n      {\"Field\": \"resources.ARN\", \"StartsWith\": [\"arn:aws:s3:::phi-data-bucket\u002F\"]}\n    ]\n  }]'\n```\n\n## Business Associate Agreement Tracking\n\n```yaml\nbaa_tracking:\n  required_when:\n    - Vendor creates, receives, maintains, or transmits PHI on your behalf\n    - Subcontractor of a business associate handles PHI\n    - Cloud service provider stores or processes PHI\n\n  not_required_for:\n    - Conduit exception (postal service, ISP carrying encrypted data)\n    - Treatment providers sharing PHI for treatment purposes\n    - Plan sponsor receiving summary health information\n\n  baa_registry:\n    format:\n      vendor_name: \"\"\n      baa_execution_date: \"\"\n      baa_expiration_date: \"\"\n      phi_types_shared: []\n      services_provided: \"\"\n      subcontractors_identified: []\n      breach_notification_sla: \"hours\"\n      last_risk_assessment: \"\"\n      next_review_date: \"\"\n      status: \"active | pending | expired\"\n\n  cloud_provider_baas:\n    aws:\n      - Sign AWS BAA via AWS Artifact in the console\n      - Applies to all HIPAA-eligible services in the account\n      - Must restrict PHI to eligible services only\n    azure:\n      - Microsoft BAA is part of Online Services Terms\n      - Automatically applies when using qualifying services\n    gcp:\n      - Sign Google Cloud BAA via Google Workspace Admin or Cloud console\n      - Covers HIPAA-eligible GCP services\n\n  review_schedule:\n    - [ ] Annual review of all active BAAs\n    - [ ] Verify vendor compliance certifications are current\n    - [ ] Confirm subcontractor BAAs are in place\n    - [ ] Update BAA registry with any vendor changes\n    - [ ] Assess vendor security posture annually\n```\n\n## Risk Analysis Automation\n\n```bash\n#!\u002Fusr\u002Fbin\u002Fenv bash\n# hipaa-risk-scan.sh - Technical risk analysis checks for HIPAA\n\necho \"=== HIPAA Technical Safeguard Checks ===\"\n\necho \"--- Encryption at Rest ---\"\n# Check for unencrypted RDS instances\nUNENCRYPTED_RDS=$(aws rds describe-db-instances \\\n  --query 'DBInstances[?StorageEncrypted==`false`].DBInstanceIdentifier' --output text)\n[ -z \"$UNENCRYPTED_RDS\" ] && echo \"PASS: All RDS instances encrypted\" || \\\n  echo \"FAIL: Unencrypted RDS: $UNENCRYPTED_RDS\"\n\n# Check for unencrypted S3 buckets\nfor bucket in $(aws s3api list-buckets --query 'Buckets[*].Name' --output text); do\n  enc=$(aws s3api get-bucket-encryption --bucket \"$bucket\" 2>\u002Fdev\u002Fnull)\n  [ -z \"$enc\" ] && echo \"FAIL: S3 bucket $bucket has no default encryption\"\ndone\n\n# Check for unencrypted EBS volumes\nUNENCRYPTED_EBS=$(aws ec2 describe-volumes \\\n  --query 'Volumes[?Encrypted==`false`].VolumeId' --output text)\n[ -z \"$UNENCRYPTED_EBS\" ] && echo \"PASS: All EBS volumes encrypted\" || \\\n  echo \"FAIL: Unencrypted EBS: $UNENCRYPTED_EBS\"\n\necho \"--- Access Control ---\"\n# Check for users without MFA\naws iam generate-credential-report > \u002Fdev\u002Fnull 2>&1 && sleep 5\naws iam get-credential-report --output text --query Content | base64 -d | \\ \u003C!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->\n  awk -F, '$4==\"true\" && $8==\"false\" {print \"FAIL: User without MFA: \"$1}'\n\n# Check for unused access keys (90+ days)\nTHRESHOLD=$(date -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>\u002Fdev\u002Fnull || date -v-90d +%Y-%m-%dT%H:%M:%S)\naws iam get-credential-report --output text --query Content | base64 -d | \\ \u003C!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->\n  awk -F, -v t=\"$THRESHOLD\" 'NR>1 && $11!=\"N\u002FA\" && $11\u003Ct {print \"WARN: Stale access key for \"$1}'\n\necho \"--- Audit Controls ---\"\n# Verify CloudTrail is logging\nCT_STATUS=$(aws cloudtrail get-trail-status --name hipaa-audit-trail --query 'IsLogging' --output text)\n[ \"$CT_STATUS\" = \"True\" ] && echo \"PASS: CloudTrail active\" || echo \"FAIL: CloudTrail not logging\"\n\n# Verify VPC flow logs\nfor vpc in $(aws ec2 describe-vpcs --query 'Vpcs[*].VpcId' --output text); do\n  fl=$(aws ec2 describe-flow-logs --filter \"Name=resource-id,Values=$vpc\" --query 'FlowLogs[0].FlowLogId' --output text)\n  [ \"$fl\" = \"None\" ] && echo \"FAIL: No flow logs for VPC $vpc\"\ndone\n\necho \"--- Transmission Security ---\"\n# Check for ALBs without HTTPS listener\nfor alb in $(aws elbv2 describe-load-balancers --query 'LoadBalancers[*].LoadBalancerArn' --output text); do\n  HTTPS=$(aws elbv2 describe-listeners --load-balancer-arn \"$alb\" \\\n    --query 'Listeners[?Protocol==`HTTPS`].ListenerArn' --output text)\n  [ -z \"$HTTPS\" ] && echo \"FAIL: ALB without HTTPS: $alb\"\ndone\n\necho \"=== Scan complete ===\"\n```\n\n## HIPAA Compliance Checklist\n\n```yaml\nhipaa_compliance_checklist:\n  administrative:\n    - [ ] Risk analysis conducted and documented\n    - [ ] Risk management plan implemented\n    - [ ] Security officer designated\n    - [ ] Privacy officer designated\n    - [ ] Workforce security awareness training completed\n    - [ ] Sanction policy documented and communicated\n    - [ ] Contingency plan (backup, DR, emergency mode) documented\n    - [ ] Business associate agreements signed for all applicable vendors\n    - [ ] Periodic evaluation\u002Faudit scheduled\n\n  technical:\n    - [ ] Unique user identification enforced\n    - [ ] MFA enabled for all PHI system access\n    - [ ] Automatic logoff configured (15-minute timeout)\n    - [ ] Encryption at rest (AES-256) for all PHI stores\n    - [ ] Encryption in transit (TLS 1.2+) for all PHI transmission\n    - [ ] Audit logging enabled for all PHI access\n    - [ ] Log retention configured for 6+ years\n    - [ ] Integrity controls on PHI (checksums, signatures)\n    - [ ] Emergency access (break-glass) procedure tested\n\n  physical:\n    - [ ] Facility access controls documented\n    - [ ] Workstation use policy in place\n    - [ ] Device and media disposal procedures documented\n    - [ ] Media re-use procedures documented\n\n  breach_response:\n    - [ ] Breach notification procedure documented\n    - [ ] Breach risk assessment methodology defined\n    - [ ] Individual notification template prepared\n    - [ ] HHS notification process understood\n    - [ ] Breach log maintained\n    - [ ] Annual breach assessment reviewed\n\n  operational:\n    - [ ] PHI data inventory maintained\n    - [ ] Minimum necessary access enforced\n    - [ ] Access reviews conducted quarterly\n    - [ ] Vendor risk assessments current\n    - [ ] Incident response plan tested annually\n    - [ ] Policies reviewed and updated annually\n```\n\n## Best Practices\n\n- Conduct a thorough risk analysis annually and after significant system changes\n- Use only HIPAA-eligible cloud services and sign BAAs before deploying PHI workloads\n- Encrypt all PHI at rest and in transit with no exceptions\n- Implement the minimum necessary standard: grant access only to the PHI needed for each role\n- Maintain audit logs of all PHI access for a minimum of 6 years\n- Train all workforce members on HIPAA policies at onboarding and annually\n- Test contingency plans (backup restore, DR failover, emergency access) at least annually\n- Track all Business Associate Agreements in a central registry with review dates\n- Document every addressable specification decision (implement, alternative, or not applicable with rationale)\n- Prepare breach notification templates and procedures before an incident occurs\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":48,"source":49,"license":14,"category":50,"metadata":51,"date_added":54,"description":7,"source_repo":55,"source_type":31,"compatibility":56,"license_source":57},"safe","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":52,"version":53},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fhipaa-compliance","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hipaa-compliance",{"tool":69,"command":70},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hipaa-compliance",{"tool":72,"command":73},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill hipaa-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fhipaa-compliance\u002FSKILL.md",true,[],[78,105,129,151,177,201],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":89,"publishedAt":43},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[90,91,92,93,94,95,80,96,39,97,37,98,31,30,99,100,101,102,103,104],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","access","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":43},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[112,113,114,115,116,117,118,119,120,121,122,123,124,98,125,31,126,127,100,128],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":43},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[136,137,138,48,35,139,140,40,141,142,143,144,145,31,30,146,147,148,149,150],"transcript","youtube transcript","youtube","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":166,"publishedAt":43},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[157,160,163],{"categoryNo":158,"categoryName":159,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":161,"categoryName":162,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":164,"categoryName":165,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000030","开发工程师",[136,137,138,167,48,168,35,139,40,169,170,171,172,143,173,31,30,174,175,176],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":43},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":161,"categoryName":162,"taxonomyType":87,"taxonomyTypeDesc":88},[138,188,189,116,48,190,191,192,193,40,171,194,195,196,197,30,198,146,199,200],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":43},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[207],{"categoryNo":158,"categoryName":159,"taxonomyType":87,"taxonomyTypeDesc":88},[209,138,210,211,48,168,169,212,213,170,171,172,143,214,173,31,30,174,215,149],"youtube full","full","google","server","dlp","credits","automatic"]