HIPAA org policy now 'latches': restricted features stay off for the rest of the session
Once a HIPAA-regulated organization is detected, Claude Code disables Artifacts, Remote Control, and other gated features for the rest of the session, even after switching accounts
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
ComplianceArea: what it touches
ImprovementsKind: in v2.1.267,
ImprovementsSection of the release
What
If Claude Code observes that you're signed into a HIPAA-regulated organization's policy during a session, that fact is now "latched" (remembered) even if the server later stops reporting it.
Features gated by this policy, including Artifacts and Remote Control, stay disabled for the rest of the session once latched, with a new user-facing message explaining why.
This is treated as a distinct "latched" state alongside the existing org_denied/unregistered/route_missing states in policy checks, and maps to the same policy_denied error code.
Switching to a non-HIPAA organization afterward does not lift the restriction; it only clears when Claude Code is restarted.
Why
This prevents a session from briefly picking up looser settings by switching organizations after a HIPAA-regulated policy was already in effect, closing a potential gap where compliance-restricted features could be re-enabled mid-session.
