hipaa-compliance-checkerlisted

# HIPAA Compliance Checker ## Overview Validates health data security compliance for healthcare-adjacent applications, ensuring HIPAA-aligned patterns and identifying security vulnerabilities. Applicable to any system handling Protected Health Information (PHI): telemedicine, fitness/health apps, insurance tech, EHR integrations, patient portals. **Bundled Resources:** - `${CLAUDE_SKILL_DIR}/references/hipaa-technical-safeguards.md` - Technical security requirements and implementation patterns - `${CLAUDE_SKILL_DIR}/references/api-security-patterns.md` - Healthcare API security best practices - `${CLAUDE_SKILL_DIR}/references/frontend-privacy-controls.md` - Client-side security measures for health data - `${CLAUDE_SKILL_DIR}/references/audit-checklist.md` - Comprehensive compliance validation checklist - `${CLAUDE_SKILL_DIR}/templates/security-headers-template.js` - HTTP security headers for healthcare applications - `${CLAUDE_SKILL_DIR}/templates/data-encryption-template.py` - Health data encryption implementation patterns --- ## ⚠ Claude Code Environment Variables — HIPAA Must-Avoid Before deploying Claude Code in a HIPAA-regulated context, verify these env vars are NOT set: | Variable | Risk | Why | |----------|------|-----| | `OTEL_LOG_RAW_API_BODIES` | **CRITICAL** | CC 2.1.111+: emits full API request/response bodies as OpenTelemetry log events. Every message containing PHI would be exported to whatever observability backend receives OTel events. | | `DISABLE_TEL