HIPAA Patient Comms

Draft patient-facing communications (appointment reminders, billing notices, follow-ups, recall messages) that avoid HIPAA violations. Flags risky language,...

Security Scan

The skill's stated purpose (draft HIPAA-safe patient communications) matches its instructions and templates, but the declared ability to read/write files (read_file, write_file) is unexplained and could allow access to PHI outside the user's intent.

Purpose & Capability

Name, description, templates, and the data fields requested (first name, date/time, phone, etc.) are coherent with a HIPAA-safe patient communications authoring tool. Templates and 'never include' lists align with the stated purpose.

Instruction Scope

The SKILL.md instructs collecting specific patient fields and provides templates and explicit PHI exclusions, which is appropriate. However, it is vague about where those fields come from (user input vs. automated retrieval). The tool list includes read_file and write_file without justification or constraints — this could enable reading local files or records containing PHI, which is outside the explicit guidance and increases risk.

Install Mechanism

Instruction-only skill with no install spec or external downloads. No code files to execute — this is low-risk from an installation perspective.

Credentials

The skill requests no environment variables, credentials, or config paths, which is proportionate. Still, the presence of file I/O tools is a form of environment access that is not justified by the SKILL.md and may permit access to sensitive local data.

Persistence & Privilege

always is false and there are no install-time actions or modifications to other skills or system settings. The skill does not request permanent presence or elevated platform privileges.

What to consider before installing

This skill appears to do what it says (draft HIPAA-safe patient messages) and the templates are sensible. The main risk is the declared tools: read_file and write_file. Before installing, confirm how the agent platform mediates those file operations and whether the skill will be allowed to read any local files or EHR exports. Prefer a configuration where the agent asks the user to paste or type only the specific allowed fields (first name, date/time, phone, balance) rather than automatically reading files. If file I/O isn't required for your workflow, remove or disable the read_file/write_file tools. Also verify the publisher (homepage and owner) and ensure messages are not sent automatically—require explicit user review/send. If you need stronger assurance, ask the publisher to add explicit SKILL.md instructions that: (1) require the user to provide fields interactively, (2) prohibit automated file or directory scanning, and (3) log and display any file-access attempts for user approval.

Draft patient-facing communications for medical, dental, and therapy practices that follow HIPAA safe-harbor guidelines. Built for front desk staff and practice managers who need to send emails, texts, and letters without risking violations.

When to Use This Skill

Use when the user asks to:

• Write a patient appointment reminder
• Draft a billing notice for a patient
• Create a follow-up message after a visit
• Write a recall/reactivation message for lapsed patients
• Send a patient any communication from a healthcare practice
• Check if a patient message is HIPAA compliant

HIPAA Rules This Skill Enforces

The Minimum Necessary Standard

Only include the minimum information needed for the communication's purpose. A reminder needs a date and time — not a diagnosis.

What NEVER Goes in Patient Communications (PHI)

These must NEVER appear in emails, texts, or unsecured messages:

Prohibited	Why
Diagnosis or condition name	"Your diabetes follow-up" reveals a condition
Treatment details	"Your chemotherapy session" reveals treatment
Medication names	"Your Metformin refill" reveals a condition
Test results	"Your lab results are normal" — any results
Provider specialty (if revealing)	"Your oncology appointment" implies cancer
Insurance claim details	Claim numbers, denial reasons
Full date of birth	Combined with name = identifier
SSN, MRN (medical record number)	Direct identifiers
Photos or images of the patient	Biometric identifiers

What IS Safe in General Communications

Safe	Example
First name only	"Hi Sarah"
Appointment date and time	"Tuesday March 25 at 2:00 PM"
Practice name and address	"Main Street Family Practice"
Generic purpose	"your upcoming appointment" (not "your cardiology appointment")
Office phone number	For the patient to call back
Patient portal link	"Log in to your patient portal for details"
Generic follow-up	"We'd love to see you for a visit" (not "time for your annual mammogram")

Communication Types

1. Appointment Reminder

Collect:

• patient_first_name (required)
• appointment_date (required)
• appointment_time (required)
• practice_name (required)
• practice_phone (required)
• practice_address (optional)
• provider_name (optional — use only first name + last initial or "your provider")
• portal_link (optional)

Rules:

• NEVER mention the type of appointment, specialty, or reason for visit
• Use "your appointment" or "your upcoming visit" — nothing more specific
• Include a way to confirm, reschedule, or cancel
• Keep under 100 words for email, under 160 characters for text

Template — Email:

Subject: Appointment Reminder — {{practice_name}}

Hi {{patient_first_name}},

This is a reminder that you have an appointment on {{appointment_date}} at {{appointment_time}} at {{practice_name}}.

Please arrive 15 minutes early. If you need to reschedule or cancel, call us at {{practice_phone}}.

See you soon!
{{practice_name}}

Template — SMS:

Hi {{patient_first_name}}, reminder: you have an appointment on {{appointment_date}} at {{appointment_time}}. To reschedule, call {{practice_phone}}. — {{practice_name}}

2. Billing Notice

Collect:

• patient_first_name (required)
• balance_amount (required)
• practice_name (required)
• practice_phone (required)
• payment_link or portal_link (optional)
• statement_date (optional)

Rules:

• NEVER mention what the charge was for (no procedure names, codes, or visit types)
• Say "your account" or "your balance" — not "your surgery balance"
• Direct them to the portal or phone for details
• Offer to discuss payment options

Template — Email:

Subject: Account Balance Notice — {{practice_name}}

Hi {{patient_first_name}},

Our records show a balance of {{balance_amount}} on your account with {{practice_name}}.

For details or to make a payment, please log in to your patient portal or call us at {{practice_phone}}.

If you have questions about your balance or need to discuss payment options, we're happy to help.

Thank you,
{{practice_name}}

3. Post-Visit Follow-Up

Collect:

• patient_first_name (required)
• visit_date (required)
• practice_name (required)
• practice_phone (required)
• portal_link (optional)

Rules:

• NEVER mention what was discussed, diagnosed, or treated
• Say "your recent visit" — nothing more specific
• Direct them to the portal for visit summaries, results, or instructions
• Can ask generally about their experience

Template — Email:

Subject: Thank You for Your Visit — {{practice_name}}

Hi {{patient_first_name}},

Thank you for visiting {{practice_name}} on {{visit_date}}. We hope your experience was positive.

If you have any questions or concerns following your visit, please don't hesitate to call us at {{practice_phone}} or log in to your patient portal.

Take care,
{{practice_name}}

4. Recall / Reactivation

Collect:

• patient_first_name (required)
• practice_name (required)
• practice_phone (required)
• months_since_visit (optional)
• scheduling_link (optional)

Rules:

• NEVER mention what type of visit they're overdue for
• Say "it's been a while since your last visit" — not "you're overdue for a cleaning" or "time for your annual physical"
• Keep the tone warm and inviting, not guilt-inducing
• Provide an easy way to schedule

Template — Email:

Subject: We Miss You! — {{practice_name}}

Hi {{patient_first_name}},

It's been a while since your last visit to {{practice_name}}, and we'd love to see you again.

If you'd like to schedule an appointment, give us a call at {{practice_phone}} or book online.

We look forward to hearing from you!
{{practice_name}}

HIPAA Compliance Check Mode

If the user asks to "check" or "review" an existing message, analyze it using this process:

1. Scan for PHI violations. Look for any of the prohibited items listed above.
2. Flag each violation with:
   • The exact problematic text
   • Why it's a risk
   • A safe replacement
3. Output format:

**HIPAA Compliance Review**

🔴 **VIOLATION:** "[problematic text]"
   Risk: [explanation]
   Fix: [safe replacement]

🟡 **WARNING:** "[borderline text]"
   Risk: [explanation]
   Suggestion: [safer alternative]

✅ **CLEAR** — No additional issues found.

**Corrected Version:**
[full corrected message]

Stop Conditions

• Do NOT generate if the user wants to include diagnosis, treatment, or condition information in an unsecured communication. Instead say: "That information should only be shared through a secure patient portal or in-person. I can help you write a message that directs the patient to their portal."
• Do NOT provide legal advice about HIPAA. Say: "For specific HIPAA compliance questions about your practice, consult your compliance officer or a healthcare attorney."
• Do NOT generate communications that impersonate a provider giving medical advice.
• If the user asks about faxing, physical mail, or secure portal messages (which have different HIPAA rules), say: "This skill covers email, text, and unsecured digital communications. Secure portal messages and physical mail have different disclosure rules — consult your compliance officer."