From healthtech-pro
HIPAA compliance, FHIR, EHR integration, audit, PHI protection. Use when building or auditing healthcare technology systems.
How this skill is triggered — by the user, by Claude, or both
Slash command
/healthtech-pro:healthtech-proThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Build HIPAA-compliant healthcare applications: FHIR API patterns, EHR integration, PHI protection, audit logging, and clinical workflow automation.
Build HIPAA-compliant healthcare applications: FHIR API patterns, EHR integration, PHI protection, audit logging, and clinical workflow automation.
Use this when:
Use this ESPECIALLY when:
Don't skip when:
// All PII/PHI data must be encrypted at rest + in transit
class PHIProtector {
// Encrypt PHI fields before storing
async encryptPatientData(patient: CreatePatientRequest): Promise<EncryptedPatient> {
return {
...patient,
ssn: await encrypt(patient.ssn, process.env.PHI_ENCRYPTION_KEY),
dob: await encrypt(patient.dob, process.env.PHI_ENCRYPTION_KEY),
medicalRecordNumber: await encrypt(patient.medicalRecordNumber, process.env.PHI_ENCRYPTION_KEY),
}
}
// Mask PHI in logs
maskForLogging(patient: Patient): SafePatient {
return {
id: patient.id,
age: calculateAge(patient.dob), // Not exact DOB
gender: patient.gender,
zip3: patient.zip.substring(0, 3), // Only first 3 digits
// No: ssn, dob, full address, phone, email
}
}
}
// HL7 FHIR R4 Patient endpoint
@FHIRResource('Patient')
class PatientResource {
async search(params: FHIRSearchParams): Promise<Bundle> {
// Audit every access
await audit.log('Patient.search', { params, user: req.user })
// Scoped by organization
const patients = await db.patient.findMany({
where: { organizationId: req.user.orgId },
})
return {
resourceType: 'Bundle',
type: 'searchset',
total: patients.length,
entry: patients.map(p => ({
resource: this.toFHIR(p),
})),
}
}
private toFHIR(patient: Patient): FHIRPatient {
return {
resourceType: 'Patient',
id: patient.id,
identifier: [{ system: 'urn:oid:1.2.3.4', value: patient.medicalRecordNumber }],
name: [{ given: [patient.firstName], family: patient.lastName }],
birthDate: patient.dob,
gender: patient.gender,
address: [{
line: [patient.addressLine1],
city: patient.city,
state: patient.state,
postalCode: patient.zip,
}],
}
}
}
-- Every PHI access must be logged
CREATE TABLE hipaa_audit_log (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
timestamp TIMESTAMPTZ NOT NULL DEFAULT now(),
user_id UUID NOT NULL,
action TEXT NOT NULL, -- 'create', 'read', 'update', 'delete'
resource_type TEXT NOT NULL, -- 'Patient', 'Observation', 'DocumentReference'
resource_id UUID NOT NULL,
patient_id UUID NOT NULL, -- Which patient's data was accessed
ip_address INET,
user_agent TEXT,
reason_code TEXT, -- 'treatment', 'payment', 'operations'
changes JSONB -- For updates: { before: {}, after: {} }
);
CREATE INDEX idx_hipaa_patient ON hipaa_audit_log(patient_id, timestamp DESC);
CREATE INDEX idx_hipaa_user ON hipaa_audit_log(user_id, timestamp DESC);
-- Retention: minimum 6 years (HIPAA requirement)
-- Consider using table partitioning by month
// Business Associate Agreement checks
const BAA_REQUIRED_SERVICES = [
'aws:healthlake',
'gcp:healthcare-api',
'azure:healthcare-apis',
'twilio:sendgrid',
]
function validateBAACoverage(service: string): void {
if (BAA_REQUIRED_SERVICES.includes(service)) {
throw new Error(`${service} requires a signed BAA before processing PHI`)
}
}
Creates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.
npx claudepluginhub haj1t/senior-dev-squad-skills --plugin healthtech-pro