HIPAA Compliance Documentation Auditor
Audit healthcare documentation for HIPAA violations and generate compliance reports
What You Can Do
You can conduct comprehensive HIPAA compliance audits of healthcare documentation, workflows, and systems to identify Protected Health Information (PHI) exposure risks. Claude analyzes your documents against HIPAA Standards, classifies violations by severity level, and produces evidence-based compliance reports with specific violation citations and prioritized corrective action plans. This creates defensible audit trails and demonstrates organizational commitment to HIPAA regulations and Business Associate Agreements.
Features
automatically detect Protected Health Information in documentation and flag at-risk storage or access patterns
categorize findings by severity (Critical, High, Medium, Low) with specific HIPAA rule citations (Privacy Rule, Security Rule, Breach Notification Rule)
rank violations by likelihood and impact to generate prioritized remediation roadmaps
review third-party compliance documentation against BAA requirements and HIPAA standards
create specific, measurable, time-bound remediation steps with responsibility assignments
produce detailed evidence records suitable for OCR inquiries, breach investigations, or compliance recertifications
evaluate authorization matrices and access logs for inappropriate PHI access patterns
distill complex audit findings into board-level compliance reports with key metrics and recommendations
Example Output
Audit Finding Example:
Violation: Unencrypted patient scheduling database accessible to non-clinical staff
- HIPAA Rule Cited: 45 CFR § 164.312(a)(2)(i) – Encryption and decryption of ePHI
- Severity: Critical
- Risk Impact: High (20+ staff members with unnecessary PHI access)
- Remediation Step: Implement AES-256 encryption on patient database; restrict access via role-based access control within 30 days
- Owner: IT Director
- Compliance Evidence: Encryption audit logs, updated access matrix
Executive Summary Section:
- Total Findings: 12
- Critical: 2 | High: 4 | Medium: 5 | Low: 1
- Estimated Remediation Timeline: 60 days
- Priority Actions: Database encryption, workforce training, Business Associate audit
What's Included
- SKILL.md instruction file with audit frameworks and HIPAA rule reference mappings:
- HIPAA Violation Classification Checklist (Privacy, Security, Breach Notification Rules):
- PHI Exposure Risk Assessment Matrix and scoring methodology:
- Audit Report Template with sections for findings, citations, severity rankings, and CAPs:
- Business Associate Compliance Review Template:
- Workforce Access Control Analysis Worksheet:
- Executive Summary format for leadership and board reporting:
Who It's For
- HIPAA Compliance Officers conducting routine or triggered audits
- Healthcare Privacy Officers preparing for OCR inquiries or breach investigations
- Compliance Managers evaluating Business Associate documentation and BAA compliance
- Internal audit teams documenting risk analysis gaps and remediation progress
- Healthcare IT leaders conducting security and access control assessments
Best For
- Systematic documentation and process audits for HIPAA violation identification
- Breach incident investigations requiring audit trail and evidence documentation
- Corrective action plan development with specific remediation timelines and ownership
- Business Associate compliance reviews and BAA validation
- Workforce access control analysis and PHI exposure mapping
- Compliance recertification and OCR inquiry preparation with defensible audit records
You might also like
You can rapidly assess political risks that directly threaten healthcare operations abroad, including government stability, regulatory capture, sanctions impact, and how political transitions affect hospital partnerships. This skill integrates healthcare-specific political factors—pharmaceutical lobby influence, medical licensing corruption, and health system reform dynamics—into a structured risk assessment that informs strategic decisions on expanding, maintaining, or withdrawing from health programs.
by github
You can systematically decode state-specific grant requirements across Medicaid, workforce development, rural health, and behavioral health programs. The skill helps you identify compliance gaps in your current processes, build state-compliant budget narratives and work plans, and create audit-ready documentation frameworks tailored to your state's unique administrative standards and reporting frequencies.
by github
Process medical staff privileging applications systematically by extracting clinical competencies from CVs and training records, cross-referencing applicant qualifications against institutional privilege scope, and flagging documentation gaps or high-risk scenarios. Generate standardized privilege request matrices and peer review summaries that highlight conflicts between requested privileges and demonstrated training, saving 2-3 hours per complex application while reducing human error in the credentialing workflow.
by github
You can design complete data governance frameworks that establish clear ownership, access controls, data quality standards, and breach protocols across EHR systems, data warehouses, and integration platforms. The skill maps regulatory requirements to organizational policies, defines data stewardship roles with accountability matrices, and creates audit procedures and metrics for ongoing compliance monitoring—all in formats ready for board presentation or regulatory review.
by github
This skill moves beyond surface-level denial categorization to uncover systemic root causes affecting your revenue cycle. You'll distinguish between preventable denials (documentation gaps, coding errors, prior auth failures), clinical denials (medical necessity disputes), administrative denials (eligibility issues, timely filing violations), and systemic denials (recurring patterns indicating workflow problems). Claude generates documented appeal strategies with specific evidence and supporting arguments tailored to each denial type.
by github
Analyze outpatient authorization requests against clinical evidence, payer guidelines, and regulatory standards to generate clear approval or denial recommendations with documented medical necessity justification. The skill transforms scattered clinical notes, procedure codes, insurance guidelines, and patient history into structured determinations that withstand peer-to-peer reviews, appeals, and regulatory audits while reducing decision time from hours to minutes.
by github
This skill walks you through conducting formal root cause analyses that move beyond individual blame to uncover systemic process failures in healthcare settings. You'll document findings using multiple structured methodologies, differentiate between human error and system design vulnerabilities, and generate actionable corrective actions that prevent incident recurrence across your organization.
by github
You can conduct comprehensive compliance audits of active grants by evaluating them against federal regulations (OMB 2 CFR 200), funder-specific terms, and institutional policies. Claude helps you identify specific compliance gaps, prioritize remediation actions, and create detailed remediation plans that protect institutional funding and reduce audit liability.
by github