{"version":"2.1.271","anchor":"one-time-hipaa-credential-withholding-notice","canonical_anchor":"one-time-hipaa-credential-withholding-notice","heading":"One-time HIPAA credential-withholding notice","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/one-time-hipaa-credential-withholding-notice","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### One-time HIPAA credential-withholding notice\n\nOrganizations tagged HIPAA now get a one-time notice that Anthropic credentials are withheld from child processes\n\n**What**\n\nIf an organization is tagged as being under HIPAA (a US health-data privacy law), Claude Code now shows a one-time notice, once per CLI session, explaining that this CLI's Anthropic credentials are withheld from child processes it spawns and from `${VAR}`-style expansion in configuration files.\n\n**Why**\n\nThis tells HIPAA-tagged organizations about a credential-handling restriction that already applies to them, so they understand why credentials aren't passed through to subprocesses or config expansion.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}