[agents](https://carteblanche.com/index.md?kind=agent) / [legal & compliance](https://carteblanche.com/index.md?category=legal) # hipaa-compliance what it does Use when the user is building a healthcare product and needs to understand HIPAA compliance. Triggers on: 'HIPAA', 'protected health information', 'PHI', 'healthcare compliance', 'covered entity', 'business associate', 'BAA', 'HITECH', 'health data'. tools it asks for Reads files · Uses the web by VoltAgent · version 1 · license MIT We imported this agent from its author’s repository. Is this yours? [Claim this listing](https://carteblanche.com/claim/hipaa-compliance) Verified · Before and after: 2 models · 1 try per case · [View source](https://github.com/VoltAgent/awesome-claude-code-subagents/blob/ed74d115b7fb7026a22a4f816a8e3250f425e3b4/categories/07-specialized-domains/hipaa-compliance.md) · [Install from your agent](https://carteblanche.com/connect.md) · [Download .zip](https://carteblanche.com/skills/hipaa-compliance/download) ## Compare the answers Answers from Claude Sonnet 5.5 and GPT-6.1 Sol · try 1 of 1 Same request, same model, once with the agent’s instructions as its system prompt and once without. Neither could use a tool. Read both and judge for yourself. [Compare the answers](https://carteblanche.com/skills/hipaa-compliance/compare) ## The models 2 models Claude Sonnet 5.5 made by Anthropic claude-sonnet-5-5 · revision not reported by the provider 1 try per case · tested 7 Nov 2026 GPT-6.1 Sol made by OpenAI gpt-6.1-sol · revision not reported by the provider 1 try per case · tested 7 Nov 2026 ## The tasks written by Carte Blanche **example-1** “We're a small startup building a telehealth scheduling app. Patients enter their name, date of birth, appointment reason, and insurance ID, and we store it all in AWS (RDS plus S3). Are we a covered entity or a business associate? Which of these fields count as PHI, and do we need a BAA with AWS?” **example-2** “I'm adding an analytics feature to our patient portal and want to send event data to a third-party analytics vendor. Events include user IDs, page URLs like /lab-results/12345, and timestamps. Could this be a HIPAA violation? Explain what de-identification requires under HIPAA, whether we need a BAA with the vendor, and what we should change in the event payloads.” ## Install Download the .zip and unzip it. Put `hipaa-compliance.md` here: Claude Code · `~/.claude/agents/` · Every project. For one project only, use .claude/agents/ inside it. It gives the agent the tools it asks for, and no others. Cursor · `~/.cursor/agents/` · Cursor also reads the Claude Code folder above. It has no tools field, so it gives every agent every tool, whatever this one asks for. Codex · Codex’s custom agents are TOML files, not Markdown, so this agent doesn’t install there. Keep its license file beside it, as `hipaa-compliance.LICENSE`: a name that doesn’t end in .md, since every .md file there is read as an agent. Then start a new session and ask for it by name. Folders checked 6 November 2026. Or [install from your agent](https://carteblanche.com/connect.md): ask it to install `hipaa-compliance` from Carte Blanche. ## Badge for your README Carte Blanche: Verified Paste this into the agent’s README. It links to this page, and shows how the listing stands whenever it’s loaded. ``` [![Carte Blanche](https://carteblanche.com/badge/hipaa-compliance.svg)](https://carteblanche.com/skills/hipaa-compliance) ``` ## About this test - **tested**: 7 Nov 2026 - **version tested**: v1 - **cases**: 2 - **tries per case**: 1 try per case - **run without the agent**: yes - **cases written by**: Carte Blanche - **size**: 4633 characters What this shows, and what it doesn’t How 2 models answered these 2 requests, with and without the agent. It says nothing about other models, and it doesn’t limit what your own agent can do. The answers were written without tools: the agent’s instructions were the system prompt, and it read no file and ran nothing. [How we test](https://carteblanche.com/how-it-works.md)