Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsreview hipaa compliance
Automated HIPAA compliance auditor for healthcare code, database schemas, and AI data boundaries with CFR citations.
$9.99
review hipaa compliance
Example session with this skill installed
Review this Node.js controller and Prisma schema for HIPAA compliance. We use Sentry for error logging and a standard OpenAI API key for generating patient summaries.
- Read your context and instructions
- Compiled the review hipaa compliance
I have completed the HIPAA compliance audit of the submitted Node.js controller and Prisma schema. The system is currently classified as
Non-Compliant due to critical unauthorized data egress and logging vulnerabilities.
HIPAA Audit Findings
| ID | Severity | Component | Violation | CFR Citation |
|---|---|---|---|---|
| HIPAA-TECH-001 | CRITICAL | openai-service.ts | ePHI sent to external LLM without BAA or ZDR | 45 CFR § 164.502(e)(1) |
| HIPAA-TECH-002 | HIGH | error-handler.ts | Plaintext ePHI leaked to Sentry via global error catch | 45 CFR § 164.530(c) |
| HIPAA-DATA-001 | CRITICAL | schema.prisma | Patient table ssn field lacks at-rest encryption | 45 CFR § 164.312(a)(2)(iv) |
| HIPAA-PRIV-001 | MEDIUM | patient-repo.ts | Wildcard query findMany() violates Minimum Necessary | 45 CFR § 164.502(b) |
[HIPAA-TECH-001] Unauthorized AI Data Egress
The current implementation uses a standard OpenAI API key to process patient summaries. Standard consumer/developer keys do not include a Business Associate Agreement (BAA).
Remediation:
// Replace standard OpenAI with Azure OpenAI (Healthcare Instance)
// Ensure 'Zero Data Retention' is enabled in the Azure Console
const client = new OpenAIClient(
endpoint,
new AzureKeyCredential(process.env.AZURE_OPENAI_KEY)
);
[HIPAA-DATA-001] Unencrypted ePHI at Rest
The Prisma schema defines ssn as a plain String. HIPAA requires technical safeguards to protect ePHI at rest.
Remediation:
Implement field-level encryption or ensure the underlying RDS instance uses AES-256 managed via AWS KMS, and document the risk assessment.
Next steps
- Immediately rotate OpenAI API keys and migrate to a BAA-compliant provider like Azure OpenAI or AWS Bedrock.
- Update the Sentry configuration to filter out
user_emailandpatient_namefrom error contexts. - Refactor database repositories to use field whitelisting instead of
SELECT *patterns.
Connects securely to your tools. The creator never sees your data.
About this skill
Manual HIPAA compliance audits are slow, prone to oversight, and legally risky. This skill automates the technical review of healthcare software architectures, database schemas, and source code to ensure strict adherence to federal regulations. It eliminates guesswork by mapping every finding to specific statutory requirements, providing developers with clear, actionable remediation paths.
What it does
- ePHI Detection: Scans schemas and code for all 18 Safe Harbor identifiers including MRNs, SSNs, and device UDIs.
- Statutory Auditing: Enforces 45 CFR Parts 160 and 164 across technical, administrative, and physical safeguard categories.
- Third-Party & AI Review: Validates BAA requirements for SaaS integrations and audits LLM data boundaries for zero-data-retention compliance.
- Severity Scoring: Categorizes defects from Critical to Informational using a deterministic 5-tier taxonomy.
- Remediation Mapping: Generates structured engineering blocks with code diffs, legal citations, and verification steps.
How it works
- Target Profiling: The agent identifies the regulatory role (Covered Entity or Business Associate) and maps the data lifecycle.
- Safeguard Verification: It audits access controls, encryption standards (AES-256), and audit log immutability against NIST 800-66 standards.
- Report Generation: The process concludes with a structured audit report including a severity scorecard and a prioritized 30-day roadmap.
Frameworks & tools
This skill references 45 CFR § 160/164, NIST SP 800-66 Rev. 2, and NIST SP 800-88. It is designed to audit SQL schemas, REST/GraphQL APIs, and cloud infrastructure configurations.
Why this beats prompting it yourself
Generic prompts often miss the nuance of "addressable" vs "required" specifications or fail to cite specific CFR subsections. This skill uses a multi-phase execution protocol that prevents common evasions, such as assuming VPCs replace the need for at-rest encryption.
Use cases
- Pre-release Audits: Reviewing new healthcare application releases for transmission security and MFA compliance.
- Cloud Infrastructure Review: Auditing AWS, Azure, or GCP configurations for BAA-covered service boundaries.
- AI Integration Safety: Verifying that LLM prompt templates strip PII before hitting external API endpoints.
- Database Schema Validation: Checking DDL files for Safe Harbor identifier exposure and unconstrained query risks.
Known limitations
Does not perform live penetration testing or dynamic runtime analysis. Reviews are based solely on provided code, schemas, and architectural documentation.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 5 days ago
- Passed all security checks, Safe to install