# Draft HIPAA Documents for a Small Practice

Small US practices need organized HIPAA documentation across risks, policies, vendors, training, and breach response. This guide helps an AI assistant draft those materials for review by counsel or a compliance officer.

## Install

```bash
npx skillstore add nexaiguy/nex-hipaa-small-practice
```

## Metadata

- Status: approved
- Slug: nexaiguy-nex-hipaa-small-practice
- Version: 1.0
- Author version: 1.0
- Skillstore revision: r1
- Version status: invalid
- Tree hash: 78d1d47b626542f40937b81f29b378a2f599622ec5a0835ce0cbc8c2941049ef
- Author: nexaiguy
- GitHub username: nexaiguy
- License: MIT
- Repository: https://github.com/nexaiguy/nex-ai-skills/tree/463aaff26593654193deb52f24d18e80ec21e323/skills/nex-hipaa-small-practice
- Ref: 3ddfdca559084abffbfdd188f2ba14b597dcfd9c
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network
- Quality score: 77
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/nexaiguy-nex-hipaa-small-practice
- Manifest: https://skillstore.pages.dev/api/skills/nexaiguy-nex-hipaa-small-practice/manifest

## Capabilities

- Guides drafting an asset inventory and security risk analysis with threat identification and likelihood and impact scoring.
- Outlines policies for access control, workforce sanctions, devices and media, contingency planning, and audit controls.
- Guides drafting a vendor inventory and business associate agreement checklist referencing 45 CFR 164.504\(e\).
- Outlines breach risk assessment and notification workflows, including a 60-day timeline and HHS reporting thresholds.
- Provides an example documentation set that includes an initial workforce training log.

## Use Cases

- Prepare an Initial Compliance File: Draft a risk inventory, core policies, and training log for a small dental practice using a cloud EHR.
- Review a New Software Vendor: Organize vendor information and a business associate agreement checklist before introducing software that handles protected health information.
- Structure a Suspected Breach Review: Prepare a draft incident assessment and notification workflow for professional review using de-identified incident details.

## Prompt Templates

### Start a Basic Documentation Set

```
Draft a HIPAA documentation outline for a three-person dental practice using a cloud EHR. Include a risk analysis, core policies, and training log. Use fictional details and identify questions for our compliance officer.
```

### Build a Scored Risk Analysis

```
Using this de-identified asset list, draft a HIPAA Security Rule risk analysis: [assets and safeguards]. Cover administrative, physical, and technical safeguards. Explain the likelihood and impact scale, distinguish assumptions from evidence, and prioritize proposed actions.
```

### Prepare Vendor and Agreement Review

```
Review this de-identified vendor inventory: [vendors, services, and data access]. Draft a business associate agreement checklist referencing 45 CFR 164.504(e). Flag missing information and clauses for counsel to review without declaring any vendor compliant.
```

### Draft a Breach Assessment Workflow

```
Use this de-identified suspected incident summary: [facts, discovery date, affected systems, and estimated scope]. Draft a breach risk assessment and conditional notification workflow. Explain how discovery dates, applicable deadlines, and HHS reporting thresholds affect the draft. Separate unknown facts from conclusions and identify decisions requiring counsel.
```

## Limitations

- The package contains only a public guide; original scripts, extension source, and standalone templates are not included.
- Coverage focuses on US HIPAA and excludes GDPR, other regulatory regimes, and additional state health privacy requirements.
- Generated documents are working drafts, not legal certification or proof of compliance, and require professional review.
- The guide does not perform technical system inspections, verify implemented safeguards, or submit breach notifications.

## Best Practices

- Use fictional or de-identified information and avoid entering patient identifiers, credentials, or other sensitive data into prompts.
- Provide accurate asset, vendor, and safeguard inventories, and distinguish implemented controls from proposed controls.
- Have counsel or a compliance officer validate drafts against current federal and applicable state requirements before use.

## Anti Patterns

- Treating generated drafts as certification that a practice complies with HIPAA.
- Assuming documentation proves safeguards are implemented or business associate agreements are executed.
- Applying a generic 60-day timeline to every incident without checking applicable deadlines, reporting thresholds, and legal advice.

## Security Audit

- Audited at: 2026-11-02T11:54:53.342\+00:00
- Summary: Both URL findings are informational attribution or catalog links, with no instructions to transmit data. The reconnaissance finding matches promotional text, not system inspection. No evidence found of prompt injection, data exfiltration, or other malicious instructions in the supplied guide.

## Stats

- Views: 0
- Downloads: 0
- Favorites: 0
- Popularity score: 0