{"version":"2.1.267","anchor":"hipaa-org-policy-latch-once-a-hipaa-regulated-org-has-sig","canonical_anchor":"hipaa-compliance-taint-now-latches-and-permanently-disable","heading":"HIPAA org policy now 'latches': restricted features stay off for the rest of the session","tier":"notice","area":"Compliance","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267\/e\/hipaa-org-policy-latch-once-a-hipaa-regulated-org-has-sig","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.267","markdown":"### HIPAA org policy now 'latches': restricted features stay off for the rest of the session\n\nOnce a HIPAA-regulated organization is detected, Claude Code disables Artifacts, Remote Control, and other gated features for the rest of the session, even after switching accounts\n\n**What**\n\n- If Claude Code observes that you're signed into a HIPAA-regulated organization's policy during a session, that fact is now \"latched\" (remembered) even if the server later stops reporting it.\n\n- Features gated by this policy, including Artifacts and Remote Control, stay disabled for the rest of the session once latched, with a new user-facing message explaining why.\n\n- This is treated as a distinct \"latched\" state alongside the existing `org_denied`\/`unregistered`\/`route_missing` states in policy checks, and maps to the same `policy_denied` error code.\n\n- Switching to a non-HIPAA organization afterward does not lift the restriction; it only clears when Claude Code is restarted.\n\n**Why** This prevents a session from briefly picking up looser settings by switching organizations after a HIPAA-regulated policy was already in effect, closing a potential gap where compliance-restricted features could be re-enabled mid-session.\n\n- Area: Compliance\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}