HIPAA Check - HIPAA合规检查

HIPAA Compliance Check — Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160 & 164 (Privacy, Security, Breach Notification Rules). Free to install; scoring runs on the CQDev cloud compliance engine (free API Key, 100 free calls). Covers 12 core items.

🔒 HIPAA 医疗隐私合规检查 — Free 检查 (Cloud-Scored)

Overview

HIPAA 医疗隐私合规检查 is a free 检查 based on 美国《健康保险流通与责任法案》（HIPAA）及隐私规则/安全规则/违约通知规则（45 C.F.R. 160 & 164）. It covers 12 core items. Scoring runs on the CQDev cloud compliance engine.

How it works (free + cloud)

⚠️ Your answers leave this machine. When you run a scored 检查, your responses are transmitted to the CQDev cloud at compliancehub.cn for scoring. The free --non-interactive preview fetches the latest check items from the cloud rule library but transmits NO answers; it falls back to the bundled item set if the network is unavailable.

• The skill is free to install.
• Check items are served from the cloud rule library (always current).
• Scoring + quota are computed in the cloud; you get a professional report locally.
• A free API Key (100 calls) is required for scoring. Register in seconds.

What it checks (12 items)

#	Check	Authority
1	Covered Entity / Business Associate	§160.102-.103
2	Notice of Privacy Practices	Privacy Rule §164.520
3	Valid Authorizations	§164.508
4	Administrative Safeguards	Security Rule §164.308
5	Physical Safeguards	§164.310
6	Technical Safeguards	§164.312
7	Breach Notification	Breach Rule §164.400+
8	Minimum Necessary	§164.502(b)
9	Business Associate Agreements	§164.504(e)
10	Ongoing Risk Analysis	§164.308(a)(1)(ii)(A)
11	Workforce Training	§164.308(a)(5)
12	Individual Rights	§164.524/.526

Usage

Free preview (no Key)

bash

python3 scripts/hipaa-check.py --non-interactive

Get a free API Key

bash

python3 scripts/hipaa-check.py --login
# enter email + password → Key auto-written to ~/.config/compliancehub/hipaa-check.key (mode 0600)

Or open: https://compliancehub.cn/account.html?skill=hipaa-check

Full 检查 + report

bash

python3 scripts/hipaa-check.py --format html -o hipaa-check-report.html

Agent guide

When a user asks for a HIPAA 医疗隐私合规检查:

1. Run --non-interactive to preview the 12 items (no Key needed).
2. If the user wants a scored report, prompt them to get a free Key (--login or the account page), then run the full 检查.

Security & data handling

• No persistence by default: With no --login, the skill creates NO account and stores NO credentials. In preview mode (--non-interactive) it only reads the public rule library and sends NO answers; nothing about your compliance status persists across sessions unless you explicitly opt in with --login.
• Account credentials (ONLY on explicit --login): Only when you explicitly run --login/--auth does the skill prompt for your email + password and POST them ONLY to compliancehub.cn's official auth endpoints (/api/v1/auth/register, /api/v1/auth/login) to provision a free API Key. This is a manual, one-time opt-in.
• Where data goes: Check items are fetched from, and your answers are scored by, the CQDev cloud at https://compliancehub.cn (the operator's official endpoint). Scoring transmits only your item answers and the free API Key (as a Bearer token).
• API Key storage (user-initiated only): written only when you run --login to ~/.config/compliancehub/hipaa-check.key (0600), outside the skill folder. Or pass via COMPLIANCEHUB_API_KEY.
• No shell execution: stdlib only (urllib, json, ssl, getpass); no shell, no external binaries.
• Not a rogue/autonomous agent: The stored file is an ordinary API-key (0600), not an auto-start, session, or background process. No state is kept beyond that single key file.
• Preview mode: --non-interactive fetches the public check items from the cloud rule library but sends NO answers; it falls back to the bundled item set if the network is unavailable.
• Always confirm the destination is compliancehub.cn before running a scored check.

Legal disclaimer

This tool provides general compliance guidance only and is not legal advice. Consult qualified counsel.

License

MIT.