hipaa-test-patterns SKILL.md skillA

hipaa-test-patterns from testland/qa is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned

mdr add testland/qa/hipaa-test-patterns@git:20260813.aa0ffc9

Pins git:20260813.aa0ffc9 in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 17 of 17 checks passed
Kind: SKILL.md skill
Repository: testland/qa
Path: plugins/qa-compliance/skills/hipaa-test-patterns/SKILL.md
Versions recorded: 5
Latest version: git:20260813.aa0ffc9, committed Aug 13, 2026
First version recorded: Jul 6, 2026
Size: 6,202 bytes
Repository stars: 11
License: MIT

Reference catalog of HIPAA Security Rule-aligned test patterns - administrative safeguards (45 CFR §164.308: workforce training, access management, contingency planning), physical safeguards (§164.310: facility access, workstation security, device disposal), technical safeguards (§164.312: access control, audit logs, integrity, transmission security); PHI handling assertions in fixtures; minimum-necessary tests per §164.502(b); BAA-scope boundary verification. Use when authoring…

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# hipaa-test-patterns

[hipaa-hhs]: https://www.hhs.gov/hipaa/

Reference catalog of test patterns by HIPAA Security Rule section
(45 CFR §164). Pair with `audit-trail-test-author`
for §164.312(b) audit-log requirements. Anchors:
[hhs.gov/hipaa][hipaa-hhs] and NIST SP 800-66.

## When to use

- Product is a Business Associate handling PHI for a Covered Entity
  (or is itself a Covered Entity).
- BAA (Business Associate Agreement) signed; need test evidence.
- HIPAA risk assessment requires test coverage evidence.
- New feature touches PHI (medical records, billing, scheduling,
  clinical decision support).

## What is PHI?

Per HHS, PHI = individually identifiable health information +
created/received/maintained/transmitted by a covered entity. The
18 HIPAA identifiers per §164.514(b)(2) (Safe Harbor):

```
1. Name
2. Geographic subdivisions smaller than state (ZIP codes need restrictions)
3. All elements of dates (except year) for dates directly related to an individual
4. Telephone numbers
5. Vehicle identifiers + license plates
6. Fax numbers
7. Device identifiers + serial numbers
8. Email addresses
9. Web URLs
10. SSN
11. IP addresses
12. Medical record numbers
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add testland/qa/hipaa-test-patterns@sha256:29c840003587d5ee

The line at the top of this page pins the label git:20260813.aa0ffc9, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_gx24xochueph3n7m.svg)](https://markdownregistry.com/a/art_gx24xochueph3n7m)

1 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 5 versions of this file, between Jul 6, 2026 and Aug 13, 2026, about one every 9 days.

version	committed	commit	size	audit
git:20260813.aa0ffc9 latest	2026-08-13	aa0ffc9	6,202 B	A	view · diff
git:20260726.19ddd36	2026-07-26	19ddd36	6,189 B	A	view · diff
git:20260724.d4db756	2026-07-24	d4db756	9,282 B	A	view · diff
git:20260718.ab29907	2026-07-18	ab29907	9,467 B	A	view · diff
git:20260706.d9cec5f	2026-07-06	d9cec5f	9,733 B	A	view

Audit of the latest version

A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (6202 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

testland/qa · 11 stars · license MIT · pushed 2026-10-20 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_gx24xochueph3n7m
GET https://markdownregistry.com/api/v1/resolve?ref=testland/qa/hipaa-test-patterns
GET https://markdownregistry.com/api/v1/blob/29c840003587d5ee4db5f06872cd137af3510e4d18df1ecf0460d0f4272a9696

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from testland/qa

CLAUDE.md CLAUDE.md file

testland/qa · CLAUDE.md

git:20261011.164aa71 · audit A · 11 stars

a11y-violation-gate SKILL.md skill

testland/qa · plugins/qa-accessibility/skills/a11y-violation-gate/SKILL.md · Builds a CI gate that fails the build on **new** WCAG / a11y violations introduced by a PR while grandfathering…