HIPAA Compliance Audit Assistant
Audit healthcare operations for HIPAA compliance gaps with evidence-based findings
What You Can Do
You can conduct comprehensive HIPAA compliance audits across your healthcare operations by analyzing workflows, documentation patterns, access logs, and Business Associate Agreements against the 18 primary violation categories. Claude identifies compliance gaps, quantifies risk exposure, and generates evidence-based corrective action plans tailored to your specific departmental or organizational context.
Features
Maps healthcare processes against Privacy and Security Rule requirements to identify unauthorized access and improper disclosure vulnerabilities
Evaluates policies, training records, and risk assessments for sufficiency and identifies missing or inadequate compliance documentation
Analyzes user behavior and access logs to detect unauthorized access patterns and segregation of duties violations
Reviews vendor agreements and third-party access controls to identify BAA compliance gaps
Identifies systemic compliance weaknesses from breach incident trends and near-miss events
Develops prioritized remediation strategies with specific implementation steps and accountability measures
Ranks findings by regulatory impact and breach probability to focus remediation efforts on highest-risk areas
Example Output
Example 1: Workflow Analysis Finding
Input: Your radiology department's image sharing process
Output:
- Gap Identified: Images transmitted via unsecured email to referring physicians (Security Rule §164.312(a)(2)(i) violation)
- Risk Level: High — PHI transmitted without encryption in transit
- Evidence: Documented in 5 workflow interviews; email logs show 847 image transmissions in past 60 days
- Remediation: Implement secure portal with audit logging; train staff on proper transmission protocol within 30 days
Example 2: Documentation Assessment
Input: Your annual risk assessment from 2021
Output:
- Gap Identified: Risk assessment 3+ years outdated; new telehealth workflows and cloud storage systems not evaluated (Security Rule §164.308(a)(1)(ii)(A) violation)
- Evidence: HIPAA Omnibus Rule updates in 2023 require assessment of emerging technology risks
- Remediation: Conduct updated risk assessment covering telehealth, EHR upgrades, and vendor integrations by Q2; allocate 80 hours IT + compliance staff
Example 3: Access Pattern Finding
Input: 90-day access logs for billing department
Output:
- Gap Identified: 12 employees accessing patient records outside assigned patient populations; 1 employee accessed records for 847 unique patients (Privacy Rule §164.502(b) violation)
- Risk Level: Critical — potential data mining or theft
- Evidence: Access patterns inconsistent with job function; no documented business justification
- Remediation: Immediate access suspension and investigation; implement role-based access controls and monthly audit procedures
What's Included
- SKILL.md: Complete HIPAA audit methodology and 18-category violation framework
- Audit Checklist Template: Department-specific compliance assessment matrix covering Privacy Rule, Security Rule, and Breach Notification requirements
- Workflow Analysis Framework: Structured interview and documentation review guide for identifying process-level compliance gaps
- Remediation Action Plan Template: Evidence-based corrective action format with priority ranking, owner assignment, and compliance deadlines
- Business Associate Agreement Review Guide: BAA compliance assessment criteria and vendor risk evaluation matrix
Who It's For
- HIPAA Compliance Officers — conducting annual audits and responding to triggered compliance investigations
- Healthcare Risk Managers — identifying systemic vulnerabilities across departments and operations
- Quality Assurance Directors — integrating compliance assessments into organizational quality improvement processes
- Privacy Officers — analyzing privacy incident patterns and developing corrective action strategies
- Healthcare Legal/Compliance Teams — preparing compliance documentation for regulatory review or breach response
Best For
- Annual or triggered departmental HIPAA compliance audits
- Workflow vulnerability assessments for unauthorized access or improper disclosure risks
- Documentation sufficiency reviews (policies, training records, risk assessments)
- Business Associate and vendor compliance evaluations
- Incident pattern analysis and corrective action planning following breaches or near-miss events
You might also like
You can rapidly assess political risks that directly threaten healthcare operations abroad, including government stability, regulatory capture, sanctions impact, and how political transitions affect hospital partnerships. This skill integrates healthcare-specific political factors—pharmaceutical lobby influence, medical licensing corruption, and health system reform dynamics—into a structured risk assessment that informs strategic decisions on expanding, maintaining, or withdrawing from health programs.
by github
You can systematically decode state-specific grant requirements across Medicaid, workforce development, rural health, and behavioral health programs. The skill helps you identify compliance gaps in your current processes, build state-compliant budget narratives and work plans, and create audit-ready documentation frameworks tailored to your state's unique administrative standards and reporting frequencies.
by github
Analyze outpatient authorization requests against clinical evidence, payer guidelines, and regulatory standards to generate clear approval or denial recommendations with documented medical necessity justification. The skill transforms scattered clinical notes, procedure codes, insurance guidelines, and patient history into structured determinations that withstand peer-to-peer reviews, appeals, and regulatory audits while reducing decision time from hours to minutes.
by github
Process medical staff privileging applications systematically by extracting clinical competencies from CVs and training records, cross-referencing applicant qualifications against institutional privilege scope, and flagging documentation gaps or high-risk scenarios. Generate standardized privilege request matrices and peer review summaries that highlight conflicts between requested privileges and demonstrated training, saving 2-3 hours per complex application while reducing human error in the credentialing workflow.
by github
You can design complete data governance frameworks that establish clear ownership, access controls, data quality standards, and breach protocols across EHR systems, data warehouses, and integration platforms. The skill maps regulatory requirements to organizational policies, defines data stewardship roles with accountability matrices, and creates audit procedures and metrics for ongoing compliance monitoring—all in formats ready for board presentation or regulatory review.
by github
This skill moves beyond surface-level denial categorization to uncover systemic root causes affecting your revenue cycle. You'll distinguish between preventable denials (documentation gaps, coding errors, prior auth failures), clinical denials (medical necessity disputes), administrative denials (eligibility issues, timely filing violations), and systemic denials (recurring patterns indicating workflow problems). Claude generates documented appeal strategies with specific evidence and supporting arguments tailored to each denial type.
by github
This skill walks you through conducting formal root cause analyses that move beyond individual blame to uncover systemic process failures in healthcare settings. You'll document findings using multiple structured methodologies, differentiate between human error and system design vulnerabilities, and generate actionable corrective actions that prevent incident recurrence across your organization.
by github
You can conduct comprehensive compliance audits of active grants by evaluating them against federal regulations (OMB 2 CFR 200), funder-specific terms, and institutional policies. Claude helps you identify specific compliance gaps, prioritize remediation actions, and create detailed remediation plans that protect institutional funding and reduce audit liability.
by github