Claude Skills for Healthcare Practices: A HIPAA-Aware 2026 Guide
Practical Skill recipes for clinics and dental practices, with a clear stance on PHI and Business Associate Agreements.
Claude skills for healthcare give a small clinic a way to package one-time prompts into reusable, auditable capabilities that any staff member can run. A Skill is a folder with instructions and reference files that Claude loads on demand. That means your prior-auth letter, your intake summary, and your discharge sheet follow the same format every time.
This guide focuses on medical and dental practices with 2 to 50 providers. It shows exactly which workflows fit a Skill, which do not, and how to stay inside HIPAA rules. Healthcare is a YMYL topic, so we cite HHS OCR guidance and Anthropic's own Trust Center for every claim about PHI.
By the end, you will have seven concrete Skill recipes, a HIPAA checklist, and a shortlist of the workflows worth automating first. Everything here reflects how Layer3 Labs configures Claude for clinics we work with in 2026.
What Claude skills for healthcare actually are
A Claude Skill is a reusable capability packaged as a folder Claude loads on demand. Anthropic launched Skills in October 2025 to replace ad-hoc prompt copy-pasting with something portable and versioned. Each Skill has a SKILL.md file with YAML frontmatter that tells Claude when to activate it.
For a clinic, this is the difference between "everyone writes their own prior-auth prompt" and "one Skill your whole staff loads." Skills work the same way in Claude.ai, Claude Code, Claude for Small Business, and the Anthropic API. That portability matters when a nurse uses the web app and a biller uses a different interface.
Skills are not Custom GPTs, not Projects, and not a live MCP server. Projects were static context. MCP servers are tools Claude calls at runtime. Skills sit in between: packaged instructions plus optional scripts and reference files.
- A Skill = SKILL.md + optional .py, .md, and .txt reference files
- YAML frontmatter tells Claude when to trigger the Skill
- Claude only reads the frontmatter until a task matches, then loads the full Skill
- Portable across Claude.ai, Claude Code, and the API
- Version-controlled in a git repo, so changes are auditable
- Best fit for repeat outputs that need identical structure every time
Want a Claude Skills rollout for your medical or dental practice that ships with a BAA, Zero Data Retention, and a signed-off Security Risk Analysis? Layer3 Labs runs the paperwork and builds the first two Skills — usually prior auth and patient intake — in about 30 days.
Book a ConsultationThe HIPAA question: PHI, BAAs, and Zero Data Retention
You can use Claude in a HIPAA-regulated workflow only under a signed Business Associate Agreement with Anthropic. The BAA is what turns a general-purpose vendor into a HIPAA business associate and makes PHI use lawful. Anthropic publishes BAA availability and Zero Data Retention terms in its Trust Center.
HHS Office for Civil Rights confirms that AI tools that create, receive, maintain, or transmit PHI on behalf of a covered entity are business associates. That means the vendor, the interface, and the way your staff enters data all sit inside HIPAA. Without a BAA and the right settings, pasting PHI into a chat window is a breach.
Zero Data Retention is a separate contractual setting. It stops prompts and outputs from being kept in Anthropic's systems after a response. For clinics, ZDR plus a BAA is the safer combination, especially for intake and prior-auth work that inherently involves identifiers.
- Sign a Business Associate Agreement before any PHI touches Claude
- Turn on Zero Data Retention on the relevant Anthropic plan
- Restrict Skill files themselves to de-identified templates and prompts, never sample PHI
- Log which staff role can trigger which Skill, and keep the log for six years
- Train staff that Skills do not change HIPAA obligations — they only shape the output
- Do a Security Risk Analysis that names Claude specifically (45 CFR 164.308)
Seven healthcare workflows that fit Claude skills for medical practices
The best Claude skills for medical practices are the ones you already run through a template. If a task has a fixed output shape and repeats every week, a Skill will pay for itself in a month. If the task is a one-time clinical judgment call, a Skill will not help.
The seven recipes below map to real time drains in a clinic. Layer3 Labs has built variants of each for practices in primary care, dermatology, dental, and behavioral health. Word counts and formats are illustrative — your Skill file should encode the exact schema your payer or state requires.
Each recipe assumes the BAA and ZDR settings from the section above are already in place. Skills define the output; they do not lower your HIPAA bar.
- Prior-authorization letter drafts — payer-specific template, medical necessity paragraph, ICD-10 and CPT slots
- Patient-intake summarization — turn a 3-page questionnaire into a 6-line SOAP-ready summary
- Referral-letter drafts — history, findings, requested consult, insurance details, in a specialty-specific format
- ICD-10 coding-audit checklists — cross-check chart notes against submitted codes and flag gaps
- Care-plan formatting — restructure clinician dictation into a payer-friendly plan of care
- Patient-education handouts — a plain-language explainer at 6th-grade reading level for a given diagnosis
- Discharge instructions in plain language — meds, red flags, follow-up window, in the reading level the patient needs
Recipe deep-dive: a prior-authorization Skill
A prior-authorization Skill packages the four pieces your team rewrites for every submission: payer format, medical-necessity paragraph, supporting-evidence citations, and the specific ICD-10 and CPT slots. The Skill turns a 25-minute letter into a 4-minute review.
The 2024 AMA prior authorization survey found physicians and staff spend an average of 12 hours per week on prior auth, and 94% of physicians report care delays because of it. A Skill will not fix payer behavior, but it can pull the writing time toward zero. That frees up front-office and clinical time for actual patient work.
The Skill lives in your practice's private repo. The SKILL.md frontmatter names the trigger ("draft prior auth letter"). Reference files hold payer-specific templates. No PHI lives in the Skill itself — the clinician pastes the case detail into a Claude session that already has BAA and ZDR turned on.
- SKILL.md names the trigger and the payer list it covers
- Reference file per payer: exact headings, medical-necessity phrasing they accept
- A ICD-10 + CPT slot table Claude fills in from the chart snippet
- A "cite the peer-reviewed evidence" step that pulls from a curated evidence list you maintain
- Optional Python helper that renders the letter as a payer-required PDF
- A version bump every time a payer changes its form
How fast are clinics actually adopting AI in 2026
Adoption of clinical AI roughly doubled between 2023 and 2025 and continues to climb in 2026. The AMA's 2024 Augmented Intelligence survey found 66% of physicians used AI in some form, up from 38% the year prior. The most common uses were documentation and administrative drafting — exactly the shape a Skill fits.
KLAS reporting on generative AI in healthcare shows the same pattern from the health-system side: pilots are moving to production, and the leading use cases are ambient scribing, message drafting, and prior authorization. Small practices are typically 12 to 18 months behind large systems, which is why 2026 is a reasonable year for a 5-provider clinic to start.
The takeaway for a practice manager: you are not early anymore. You are on-time. Peers are running Skills for the same tasks. Waiting another year mostly means more staff hours lost to prior auth and intake.
- 66% of US physicians report using AI in some form (AMA, 2024) — up from 38% in 2023
- Documentation and admin drafting lead all use cases, ahead of clinical decision support
- Small and midsize practices trail large systems by 12–18 months
- Prior auth is the workflow with the highest reported ROI in KLAS AI reports
- Ambient scribing is a separate product category — Skills complement, not replace, it
What NOT to put in a Claude Skill
Skills are the wrong tool for anything that requires live judgment, real-time data lookup, or a definitive clinical answer. A Skill produces a well-shaped output every time; it does not verify medical necessity, it does not read your EHR, and it does not replace a clinician.
If the task changes based on the patient in front of you in a way that a template cannot capture, a Skill will produce false confidence. Prescribing decisions, differential diagnosis, and any output that touches billing fraud risk should stay off the Skill list. Use Claude conversationally with a human in the loop for those instead.
The pattern to look for: repeatable output shape, low variance, high volume. If you have that, a Skill wins. If any of those three are missing, keep the workflow in a plain Claude chat or use an MCP integration instead.
- Diagnostic reasoning — not a Skill; needs a clinician
- Live EHR lookups — use an MCP server, not a Skill
- Insurance eligibility checks — API integration, not a Skill
- Anything that would bill a code the clinician did not choose — hard stop
- Answers a patient reads without clinician review — needs a human sign-off step
- Interpreting imaging or labs — not a Skill and not Claude's job today
A 30-day rollout plan for a 5-to-20-provider practice
A safe rollout takes about 30 days from BAA signature to first Skill in daily use. The bottleneck is almost never the technology — it is compliance sign-off and staff training. Budget your calendar around those two.
Week 1 is contracts and settings: BAA, Zero Data Retention, staff account provisioning, and a written policy naming who can trigger which Skill. Week 2 is the first Skill build (usually prior auth or intake). Week 3 is a supervised pilot with one clinician and one biller. Week 4 is the second Skill, staff training, and a documented review cycle.
The measure of success is not "we shipped a Skill." It is "the prior-auth queue dropped from 12 hours a week to under 3." Track the before number now, before you start.
- Week 1 — sign BAA, enable ZDR, write internal AI-use policy, do the Security Risk Analysis update
- Week 2 — build first Skill (prior auth) with a payer-specific template and de-identified test cases
- Week 3 — pilot with one clinician and one biller; log time saved and any errors
- Week 4 — build second Skill (intake summary), train the wider team, set a quarterly review cadence
- Ongoing — quarterly payer-template refresh and annual HIPAA workforce training that names Claude
Frequently Asked Questions
- Claude can be used in HIPAA-regulated workflows only when Anthropic has signed a Business Associate Agreement with your practice and the account is configured for Zero Data Retention. HIPAA compliance is a shared responsibility: the BAA plus your own policies, training, and Security Risk Analysis are what make the use lawful. Check current BAA availability on Anthropic's Trust Center before starting.
- A Claude Skill is a reusable, versioned capability — a folder with instructions and reference files — that Claude loads when a matching task comes up. For a clinic, that usually means one Skill per repeat output: prior-auth letters, intake summaries, referral drafts, patient handouts. Skills do not change your HIPAA obligations; they only lock in the format of the output.
- No. The Skill itself should hold only de-identified templates, payer formats, and prompt instructions. PHI enters the Claude session when a clinician pastes case detail into a BAA-covered, ZDR-enabled conversation. Keeping PHI out of the Skill file makes the Skill safe to store in a normal git repo.
- A Skill is a portable, dynamically loaded capability that runs in any Claude surface — web, Code, API, Small Business. A Claude Project was a static set of context files scoped to a single Project. A Custom GPT is OpenAI's competing product on a different runtime. For a small practice, Skills are the more flexible fit because they travel with the user across interfaces.
- Small clinics can start on Claude for Small Business or the API, provided Anthropic has signed a BAA for that plan and Zero Data Retention is available. Larger groups usually move to Enterprise for SSO, audit logs, and per-role Skill controls. Confirm the current BAA scope with Anthropic before you commit — the answer changes as their plans evolve.
- Prior authorization letter drafting is almost always the fastest ROI. The AMA reports physicians and staff spend an average of 12 hours per week on prior auth, and the letter itself is a fixed template. A well-built Skill can drop drafting time by 70 to 90 percent, which is 8 or more staff hours a week back for a 5-provider clinic.
- No, and it should not. Ambient scribing tools listen to the encounter and produce a structured note; Skills reshape text you already have. The two are complementary — scribes handle the visit, Skills handle prior auth, referrals, and handouts around it. Most practices we work with run both.
- Keep the Skill in version control, log every run, and store the input plus output for the six-year HIPAA retention window. Auditors want to see three things: a BAA on file, a documented Security Risk Analysis that names Claude, and a record of which staff role triggered which Skill and when. Layer3 Labs helps clinics set up that logging as part of the rollout.
Get a HIPAA-Aware Claude Skills Rollout for Your Practice
Layer3 Labs helps medical and dental practices roll out Claude Skills for prior auth, intake, referrals, and patient handouts — with the BAA, ZDR, and Security Risk Analysis paperwork sorted before any PHI moves. Book a free 30-minute audit and we will map your top three time drains to specific Skill recipes.
Book Your Free 30-Min AI Audit