HIPAA Security Rule expert for US healthcare compliance. Deep knowledge of 45 CFR Part 164 Subpart C, Administrative/Physical/Technical Safeguards, Required vs Addressable specifications, Risk Analysis, Business Associate Agreements, and HHS OCR enforcement.
SkillScore100Maintained
Automatic
◆Clinical / Healthcare pack
Last verified 8/23/2026
What it changes
Passed 22 of 22 test cases with the skill, and 19 of 22 without it.
Without skill86%
With skill100%
Checks it passed that the model alone missed
States the maximum annual cap of $1.9 million.
Recommends NIST SP 800-30 as the standard risk assessment methodology guide.
Identifies `usa-federal-law-hipaa-security-rule-2013` as the SCF framework ID.
3 fixed19 passed either way0 still failing0 broke
Pass-rate lift
+14 pp
Tokens
+251%
Agent turns
0%
Response time
+3%
Model gemini-3.6-flashMeasured 8/23/2026v122 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
A GRC engineer wants to map HIPAA Security Rule requirements to the Secure Controls Framework (SCF) database. Provide the precise SCF framework crosswalk identifier used for the 2013 HIPAA Security Rule.
What was checked, without and with the skill
Checked
Without skill
With skill
Identifies `usa-federal-law-hipaa-security-rule-2013` as the SCF framework ID.
Missed
Passed
case-11 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md414 linessingle file
HIPAA Security Rule Expert
Deep expertise in the Health Insurance Portability and Accountability Act (HIPAA) Security Rule - the U.S. federal regulation governing the protection of electronic Protected Health Information (ePHI).
Expertise Areas
HIPAA Security Rule Overview
Regulatory Citation: 45 CFR Part 164, Subpart C (Security Standards for the Protection of Electronic Protected Health Information)
Effective Date: April 21, 2003 (Compliance Date: April 20, 2005)
Enforcement: U.S. Department of Health and Human Services (HHS) - Office for Civil Rights (OCR)
Guidance Document: NIST SP 800-66 Rev. 2 (An Introductory Resource Guide for Implementing the HIPAA Security Rule)
Scope:
Applies to electronic PHI (ePHI) only - not paper records or oral communications
Covered Entities (CEs): Healthcare providers, health plans, healthcare clearinghouses that transmit ePHI
Business Associates (BAs): Vendors/contractors who create, receive, maintain, or transmit ePHI on behalf of CEs (e.g., cloud providers, EHR vendors, billing companies, data analytics firms)
Subcontractors: BAs must have contracts with their own subcontractors
What is ePHI?
Individually identifiable health information in electronic form
Includes any demographic information collected from an individual that:
Relates to physical/mental health condition
Relates to provision of healthcare
Relates to payment for healthcare
18 HIPAA identifiers (names, dates, medical record numbers, etc.) + health information
Enforcement and Penalties
OCR Enforcement Triggers:
Breach Reports: Unsecured ePHI affecting 500+ individuals (must report to OCR within 60 days)
Complaints: Patients/employees filing complaints with OCR