HIPAA Compliance

• You are building a healthcare SaaS product, EHR/EMR integration, or any system that stores or transmits patient data
• You need AWS infrastructure (Terraform) templates that are HIPAA-eligible out of the box
• You are implementing FHIR or HL7 APIs and need OAuth 2.0 scope enforcement and audit logging patterns
• You are preparing for a first pilot with a covered entity and need a launch-readiness checklist covering BAAs, risk analysis, and pen testing requirements

• Your application handles no patient data and has no connection to covered entities or business associates
• You need legal advice or formal HIPAA attestation — this skill provides technical guidance, not legal counsel
• You are working in a non-AWS cloud environment and need provider-specific infrastructure templates beyond what AWS offers

Automatically applies all 18 HIPAA PHI identifiers to flag when health data combined with any identifier becomes regulated. Covers names, SSNs, IP addresses, dates, device IDs, and more.

Provides Terraform code for HIPAA-eligible VPC architecture, KMS key policies, encrypted RDS instances, and S3 bucket configurations with public access blocking and versioning enabled.

Generates Python audit log patterns that capture user, action, resource type, and resource ID — without ever including PHI values in log entries. Includes error message sanitization utilities.

Implements role-based PHI access matrices (attending physician, billing staff, IT admin, researcher) with Python decorator enforcement at the API layer before data retrieval.

Produces de-identification utilities for dev and test environments using deterministic tokenization to preserve referential integrity while suppressing all 18 PHI identifiers.

Tracks required Business Associate Agreements for AWS services and third-party vendors (Auth0, Datadog, Sentry, SendGrid, etc.) and provides staged launch gates for founders approaching their first covered entity pilot.

A founder building a patient scheduling or telehealth platform gets a complete AWS architecture diagram, Terraform baseline, and BAA checklist before writing a single line of application code.

A backend engineer implementing a FHIR R4 Patient endpoint gets OAuth 2.0 scope enforcement, rate limiting configuration, minimum necessary field filtering, and audit logging wired together in a FastAPI example.

A developer submits a pull request touching a patient data path and uses the skill's code review checklist to verify no PHI appears in logs, error messages, URL parameters, S3 keys, or environment variables.

An engineering team needs realistic test data without using real patient records. The skill generates a Safe Harbor de-identification pipeline that replaces all identifiers while preserving foreign key relationships.