You'll notice
Organizations tagged HIPAA now get a one-time notice that Anthropic credentials are withheld from child processes
What
If an organization is tagged as being under HIPAA (a US health-data privacy law), Claude Code now shows a one-time notice, once per CLI session, explaining that this CLI's Anthropic credentials are withheld from child processes it spawns and from ${VAR}-style expansion in configuration files.
Why
This tells HIPAA-tagged organizations about a credential-handling restriction that already applies to them, so they understand why credentials aren't passed through to subprocesses or config expansion.