Verified:GitHub

healthcare-phi-compliance

Define healthcare PHI/PII classification with RBAC-style access control and auditable tracking for APIs and databases.

Updated Sep 13, 2025

Search Tags:#access control #row level security #audit logging #data leakage #hipaa #phi pii #encryption and sanitization

Ready to run

npx skills add https://github.com/llmh333/employee_management_spring --skill healthcare-phi-compliance-llmh333

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: healthcare-phi-compliance
Source: https://github.com/llmh333/employee_management_spring/tree/main/.gemini/skills/healthcare-phi-compliance
Command: npx skills add https://github.com/llmh333/employee_management_spring --skill healthcare-phi-compliance-llmh333

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you prevent accidental exposure of sensitive patient and personal data by providing practical patterns for classification, strict access control, and tamper-resistant auditing in healthcare systems.

Core Features & Use Cases

Data classification guidance (PHI vs PII) to standardize what must be protected across APIs, storage, and logs.
Access control patterns using Row-Level Security (RLS) to enforce facility-level and role-aware isolation for multi-tenant setups.
Audit trail design and leak-vector checklists to ensure every PHI/PII access or modification is logged and to block common failure modes like verbose errors, unsafe logging, and identifier leakage in URLs.
Use case example: When building an API for patient records, apply RLS policies so staff can only read records from their assigned facility, and log each read/update with opaque identifiers instead of names or medical record numbers.

Quick Start

Ask the AI to generate an implementation checklist and example RLS + auditing policy set for your patient tables based on your roles, facilities, and audit requirements.

Frequently Asked Questions about healthcare-phi-compliance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I implement row level security for multi-tenant healthcare databases to protect PHI?▼

Row level security protects PHI by enforcing facility-level and role-aware isolation, ensuring staff can only access patient records from their assigned facility. You apply explicit RLS policies to patient tables to scope read and write access per tenant.

What is the difference between PHI and PII when classifying healthcare data?▼

PHI includes identifiable health information requiring strict protection, while PII covers broader personal identifiers. Data classification standardizes what must be protected across APIs, storage, and logs to prevent accidental exposure of sensitive patient information.

How do I design audit logging for HIPAA compliance without leaking patient identifiers?▼

Audit logging for HIPAA compliance captures structured entries for every PHI access or modification using opaque identifiers instead of names or medical record numbers. This tamper-resistant tracking blocks common leak vectors like verbose errors and unsafe console output.

What are common PHI leak vectors in healthcare API design and how can I prevent them?▼

Common PHI leak vectors include client errors, URLs, browser storage, and unsafe console output. Prevention requires guardrails that prohibit PHI exposure in these channels, combined with structured audit entry capture and explicit read/write audit behaviors.

Can I use this approach for facility-scoped access control in a multi-tenant healthcare setup?▼

Yes, facility-scoped access control is designed for multi-tenant isolation. Role-aware RLS policies ensure staff can only read records from their assigned facility, with insert-only audit behaviors and explicit read/write tracking for every patient data interaction.