hipaa-rails

What problem does it solve?

Rails applications that handle protected health information (PHI) often fail to meet HIPAA requirements, exposing organizations to legal penalties, data breaches, and compliance failures. This Skill encodes the engineering controls required by the HIPAA Security Rule for Rails apps, eliminating guesswork for developers building healthcare or telehealth products.

Core Features & Use Cases

• PHI Encryption at Rest: Implements Rails Active Record Encryption for sensitive health data, with guidance on deterministic vs non-deterministic encryption for queryable fields.
• Immutable Audit Logging: Provides patterns for logging all PHI access with 6-year retention, ensuring logs survive source record deletion as required by HIPAA.
• Access Control & Session Security: Includes role-based access control (RBAC) examples, minimum necessary access redaction, and HIPAA-aligned session timeout configurations.
• Compliance Workflows: Covers break-glass access logging, PHI deletion request handling, vendor BAA validation, and breach detection setup.
• Use Case: A telehealth startup building a Rails app to store patient medical records can use this Skill to implement required safeguards like encrypting SSNs, logging all patient record access, and verifying all third-party vendors have signed BAAs.

Quick Start

Use the hipaa-rails skill to implement required HIPAA engineering controls for your Rails app that handles protected health information, including encryption, audit logging, and access restrictions.