Healthcare Compliance Config

# CLAUDE.md — Healthcare Compliance Config

## HIPAA Data Handling
- NEVER log, print, or store PHI in plaintext
- All PHI must be encrypted at rest (AES-256) and in transit (TLS 1.2+)
- Access to PHI requires role-based authorization
- De-identify data for development and testing environments

## Audit Logging Requirements
- Log all PHI access: who, what, when, why
- Logs must be immutable and retained for 6 years
- Include: user ID, action, resource, timestamp, IP address
- Alert on anomalous access patterns (bulk exports, off-hours)

## Code Review Checklist (healthcare-specific)
- [ ] No PHI in logs, error messages, or comments
- [ ] Encryption applied to all data at rest and in transit
- [ ] Access controls enforce minimum necessary principle
- [ ] Audit trail captures all data access events
- [ ] Data retention policies implemented correctly