Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

HIPAA Compliance Automator Skill · a5c-ai | DecimalAI

a5c-ai/hipaa-compliance-automator

SkillScore95Maintained

HIPAA security and privacy compliance automation for ePHI protection, safeguards assessment, and audit preparation

legalby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Clinical / Healthcare pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-hipaa-compliance-automator/SKILL.md

decimalai skills pull a5c-ai-hipaa-compliance-automator --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-hipaa-compliance-automator/SKILL.md https://app.decimal.ai/s/a5c-ai-hipaa-compliance-automator/SKILL.md

Raw file: /s/a5c-ai-hipaa-compliance-automator/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-hipaa-compliance-automator.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 25d ago

Yes — +36% lift · at higher cost+53% tokens0% turns95% of whole cases pass with skill (21/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-25%	0%
case-03	✗→✓	▲ Improved	103%	0%
case-11	✗→✓	▲ Improved	14%	0%
case-13	✗→✓	▲ Improved	113%	0%
case-14	✗→✓	▲ Improved	-23%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/security-compliance/skills/hipaa-compliance-automator/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

HIPAA Compliance Automator Skill

Purpose

Automate Health Insurance Portability and Accountability Act (HIPAA) compliance activities including ePHI inventory, safeguards assessment, risk analysis, Business Associate Agreement management, and breach notification procedures.

Capabilities

ePHI Inventory and Tracking

Discover and catalog electronic Protected Health Information
Map ePHI data flows between systems
Identify ePHI storage locations
Track ePHI access and usage
Document minimum necessary standards

Administrative Safeguards Assessment

Security management process evaluation
Workforce security procedures review
Information access management assessment
Security awareness training tracking
Security incident procedures review
Contingency plan evaluation
Business associate oversight

Technical Safeguards Validation

Access control verification
Audit controls assessment
Integrity controls validation
Transmission security review
Encryption verification (at rest and in transit)
Authentication mechanisms review

Physical Safeguards Assessment

Facility access controls review
Workstation use and security
Device and media controls
Physical security documentation

Business Associate Management

BAA inventory and tracking
BAA compliance monitoring
Subcontractor BAA tracking
BAA renewal management
Risk assessment for BAs

Breach Notification Procedures

Breach assessment and documentation
Risk assessment for notification determination
HHS notification tracking (60-day rule)
Individual notification management
Media notification for large breaches (500+)

Risk Analysis

Comprehensive risk assessment
Threat and vulnerability identification
Risk level determination
Safeguard recommendations
Risk treatment tracking

HIPAA Rules Coverage

Privacy Rule

Use and disclosure limitations
Minimum necessary standard
Patient rights
Notice of Privacy Practices
Authorization requirements

Security Rule

Administrative safeguards (164.308)
Physical safeguards (164.310)
Technical safeguards (164.312)
Policies and procedures (164.316)

Breach Notification Rule

Discovery and notification timelines
Risk assessment methodology
Notification content requirements
Documentation requirements

Integrations

Compliancy Group: HIPAA compliance platform
HIPAA One: Compliance management
Accountable HQ: HIPAA compliance software
Custom audit tools: Organization-specific solutions
EHR Systems: Electronic health records integration

Target Processes

HIPAA Security and Privacy Compliance
Security Risk Analysis
Business Associate Compliance
Breach Response Process
Compliance Audit Preparation

Input Schema

json
{
  "type": "object",
  "properties": {
    "assessmentType": {
      "type": "string",
      "enum": ["full", "security", "privacy", "risk", "breach", "baa"],
      "description": "Type of HIPAA assessment"
    },
    "entityType": {
      "type": "string",
      "enum": ["covered_entity", "business_associate", "hybrid"],
      "description": "HIPAA entity classification"
    },
    "scope": {
      "type": "object",
      "properties": {
        "systems": { "type": "array", "items": { "type": "string" } },
        "facilities": { "type": "array", "items": { "type": "string" } },
        "businessAssociates": { "type": "array", "items": { "type": "string" } }
      }
    },
    "breachDetails": {
      "type": "object",
      "properties": {
        "discoveryDate": { "type": "string", "format": "date" },
        "description": { "type": "string" },
        "affectedIndividuals": { "type": "integer" },
        "phiCategories": { "type": "array" }
      }
    },
    "existingDocumentation": {
      "type": "string",
      "description": "Path to existing HIPAA documentation"
    }
  },
  "required": ["assessmentType", "entityType"]
}

Output Schema

json
{
  "type": "object",
  "properties": {
    "assessmentId": {
      "type": "string"
    },
    "assessmentType": {
      "type": "string"
    },
    "entityType": {
      "type": "string"
    },
    "assessmentDate": {
      "type": "string",
      "format": "date-time"
    },
    "ephiInventory": {
      "type": "object",
      "properties": {
        "systems": { "type": "array" },
        "dataFlows": { "type": "array" },
        "storageLocations": { "type": "array" }
      }
    },
    "safeguardsAssessment": {
      "type": "object",
      "properties": {
        "administrative": {
          "type": "object",
          "properties": {
            "implemented": { "type": "integer" },
            "partiallyImplemented": { "type": "integer" },
            "notImplemented": { "type": "integer" }
          }
        },
        "technical": { "type": "object" },
        "physical": { "type": "object" }
      }
    },
    "riskAnalysis": {
      "type": "object",
      "properties": {
        "threats": { "type": "array" },
        "vulnerabilities": { "type": "array" },
        "riskLevel": { "type": "string" }
      }
    },
    "gapAnalysis": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "standard": { "type": "string" },
          "requirement": { "type": "string" },
          "currentState": { "type": "string" },
          "gap": { "type": "string" },
          "remediation": { "type": "string" },
          "priority": { "type": "string" }
        }
      }
    },
    "breachAssessment": {
      "type": "object"
    },
    "complianceScore": {
      "type": "number"
    },
    "recommendations": {
      "type": "array",
      "items": { "type": "string" }
    }
  }
}

Usage Example

javascript
skill: {
  name: 'hipaa-compliance-automator',
  context: {
    assessmentType: 'full',
    entityType: 'covered_entity',
    scope: {
      systems: ['EHR', 'Patient Portal', 'Billing System'],
      facilities: ['Main Hospital', 'Outpatient Clinic']
    }
  }
}

Illustrative Want to see what a5c-ai/hipaa-compliance-automator would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:51 UTC · 22 cases

Lift

+36%

95% vs 59%

Agent turns

0%

1.0 vs 1.0

Tokens

+53%

5,026.68 vs 3,288.64

fail → pass · 8pass → pass · 13fail → fail · 1

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We are a covered entity operating a primary hospital and two outpatient clinics. We need to perform a full HIPAA assessment across our Electronic Health Record, Billing Software, and Patient Portal systems. Please execute this review and return a structured JSON response containing the assessment metadata, ePHI inventory and data flows, safeguard implementation counts across administrative, technical, and physical controls, identified threats and overall risk level, a detailed gap analysis listing standards and remediation priorities, our overall compliance score, and actionable recommendations.	fail→pass	42,591	26,254	-38%	1	1	0%	7,935	5,922	-25%	0	0	—
case-02 As a business associate offering cloud backup solutions, we logged a potential data breach on 2023-11-05 involving roughly 750 patient records with names and clinical codes. Please process a breach assessment and output a report containing the breach assessment summary, threat and vulnerability analysis, gap analysis array outlining requirements and remediations, numerical compliance score, and recommended next steps.	fail→fail	31,856	37,166	+17%	1	1	0%	4,952	7,495	+51%	0	0	—
case-03 Our university medical center operates as a hybrid entity and needs a security assessment targeting our telehealth platform and third-party vendors. Conduct this assessment and output a JSON schema with the assessment ID and date, ePHI storage mapping, safeguard breakdown metrics, overall risk analysis level, itemized gap list with priority flags and remediation guidance, compliance score, and top recommendations.	fail→pass	25,726	26,815	+4%	1	1	0%	2,887	5,847	+103%	0	0	—
case-04 We are auditing our hospital billing department's disclosure practices where administrative staff request full medical histories for claims processing. Staff insist that full patient records are convenient for verification. Provide a structured evaluation report detailing current state, privacy policy gaps, and remediation steps.	pass→pass	23,817	30,115	+26%	1	1	0%	3,093	5,843	+89%	0	0	—
case-05 An electronic health record database breach exposing 1,200 patient records occurred on January 10th and was discovered on January 12th. Some team members suggest waiting 90 days to report until internal remediation is complete. Outline the regulatory reporting deadlines for notifying HHS and affected individuals.	pass→pass	17,509	18,757	+7%	1	1	0%	2,215	3,990	+80%	0	0	—
case-06 Our clinic experienced a server ransomware attack compromising 650 patient records in a single jurisdiction. Our PR team wants to know if individual letter notifications are sufficient or if public press releases are required. Provide a compliance summary for breach notifications.	pass→pass	18,862	20,306	+8%	1	1	0%	2,571	4,325	+68%	0	0	—
case-07 We are preparing an internal audit for our security management process, workforce training, and incident procedures. Evaluate our operational posture against administrative HIPAA Security Rule requirements.	pass→pass	26,571	24,986	-6%	1	1	0%	3,811	5,168	+36%	0	0	—
case-08 Our telehealth startup stores ePHI in PostgreSQL databases and transmits patient video feeds over network sockets. Assess our technical controls for data protection.	pass→pass	20,361	28,217	+39%	1	1	0%	2,977	5,783	+94%	0	0	—
case-09 Our outpatient clinic has nurse workstations placed in public waiting areas with unmonitored USB ports and open screens. Analyze physical safeguard compliance and list recommendations.	pass→pass	19,827	18,424	-7%	1	1	0%	2,435	5,047	+107%	0	0	—
case-10 Our cloud analytics vendor uses a third-party data center sub-processor to store ePHI backup files. The vendor claims their BAA with us automatically covers their sub-processors. Evaluate this statement and describe BAA requirements.	pass→pass	18,446	22,667	+23%	1	1	0%	2,270	4,500	+98%	0	0	—
case-11 We are conducting a formal Security Risk Analysis for our cloud EHR platform. Map potential threats, vulnerabilities, and risk levels into a structured JSON payload according to standard output key structure.	fail→pass	24,593	23,628	-4%	1	1	0%	4,736	5,391	+14%	0	0	—
case-12 Assess our hospital network's audit logging compliance where domain controllers currently lack centralized ePHI access log retention. Provide a gap analysis JSON array detailing standard, requirement, current state, gap, remediation, and priority for each gap item.	pass→pass	24,652	22,707	-8%	1	1	0%	3,515	4,876	+39%	0	0	—
case-13 Catalog electronic protected health information flowing between our patient portal, cloud laboratory portal, and internal billing system. Generate a JSON inventory output.	fail→pass	21,070	30,026	+43%	1	1	0%	3,330	7,079	+113%	0	0	—
case-14 A university operating a medical center alongside non-healthcare academic departments wants to configure a HIPAA assessment payload. Specify the proper entity classification parameter and system scope structure in JSON format.	fail→pass	17,178	10,792	-37%	1	1	0%	3,399	2,618	-23%	0	0	—
case-15 We want to run a targeted vendor evaluation on our third-party billing agency's contract status and compliance risk. Formulate the initial input JSON object for this assessment.	fail→pass	14,497	5,154	-64%	1	1	0%	2,756	2,503	-9%	0	0	—
case-16 Calculate our organization's overall compliance metric based on completed administrative, technical, and physical safeguard reviews. Return the result in the standard schema format.	fail→pass	11,899	19,381	+63%	1	1	0%	1,373	4,531	+230%	0	0	—
case-17 Evaluate our hospital's emergency mode operation plan, disaster recovery procedures, and data backup strategy. Identify which HIPAA safeguard category governs these plans.	pass→pass	20,474	19,482	-5%	1	1	0%	2,646	5,403	+104%	0	0	—
case-18 Our clinic maintains security policies on an informal internal wiki without version control or formal review logs. Evaluate this policy maintenance practice against HIPAA Security Rule standards.	pass→pass	20,830	20,934	+0%	1	1	0%	2,642	4,206	+59%	0	0	—
case-19 We discovered an unencrypted laptop theft on 2024-02-01 containing 120 patient names and treatment records. Format the breach details parameters for an automated assessment input JSON.	fail→pass	14,240	11,338	-20%	1	1	0%	1,739	2,822	+62%	0	0	—
case-20 Our hospital gift shop and outpatient pharmacy process credit card payments via POS terminals. We need an audit of our payment card processing environment against PCI-DSS v4.0 Requirement 3 for primary account number storage.	pass→pass	23,035	28,143	+22%	1	1	0%	3,925	5,418	+38%	0	0	—
case-21 Our company developed an AI diagnostic software algorithm for mammogram image analysis. We need to prepare a 510(k) premarket notification submission for FDA clearance.	pass→pass	21,711	23,548	+8%	1	1	0%	2,805	5,578	+99%	0	0	—
case-22 We are launching a Phase II clinical trial for an oncology drug. Draft an Institutional Review Board (IRB) patient informed consent form detailing research risks, voluntary participation, and study protocol.	pass→pass	31,284	31,940	+2%	1	1	0%	4,338	6,242	+44%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +36 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 59.1%
Pass rate with the skill: 95.5%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 09:51 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

We are a covered entity operating a primary hospital and two outpatient clinics. We need to perform a full HIPAA assessment across our Electronic Health Record, Billing Software, and Patient Portal systems. Please execute this review and return a structured JSON response containing the assessment metadata, ePHI inventory and data flows, safeguard implementation counts across administrative, technical, and physical controls, identified threats and overall risk level, a detailed gap analysis listing standards and remediation priorities, our overall compliance score, and actionable recommendations.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run95

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+69% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 25 days ago

Other measured skills in the registry, with their headline benchmark lift.