{"version":"2.1.275","anchor":"new-hipaa-evidence-check-gates-allow-web-fetch-and-allow-des","canonical_anchor":"new-hipaa-evidence-check-gates-allow-web-fetch-and-allow-des","heading":"New HIPAA-evidence tracking now gates web-fetch and design-sync policy checks","tier":"soon","area":"Compliance","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275\/e\/new-hipaa-evidence-check-gates-allow-web-fetch-and-allow-des","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275","markdown":"### New HIPAA-evidence tracking now gates web-fetch and design-sync policy checks\n\nClaude Code now tracks HIPAA-related evidence per account and can block web-fetch or design-sync access based on it\n\n**Unclear.** placeholder\n\n**What**\n\n- Session and organization-policy state now track HIPAA-related evidence: whether HIPAA-relevant information has been seen (`hipaa_seen`), seen but incomplete (`hipaa_seen_incomplete`), or ruled out (`hipaa_ruled_out`). This replaces a simpler flat list of \"seen identities\" with a richer evidence structure that also tracks confirm\/refuse timestamps (`diskConfirmedAtMs`, `diskRefusedAtMs`) and distinguishes IO failures from content-based unusability.\n\n- This evidence is now checked before allowing the `allow_web_fetch` and `allow_design_sync` actions; if the check fails, the policy verdict returns `org_denied`, a new failure path that did not exist before.\n\n- A separate feature gate (`tengu_tranquil_crescent`) can also force this same check to fail immediately, hard-blocking `allow_web_fetch`\/`allow_design_sync` regardless of the evidence gathered.\n\n**Why**\n\nThis adds a compliance check so web-fetch and design-sync features can be denied for organizations subject to HIPAA rules until their status is properly established, closing a gap where those actions could otherwise run without that check.\n\n- Flag `tengu_tranquil_crescent`: Off in both readings (read for one account on one subscription tier against v2.1.275; this account: off, anonymous baseline: off, compiled default: not a boolean we can read) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Compliance\n- Tier: Nothing to try yet\n- Useful: 2\/5\n- Signal: 2\/5\n- Present in the build but not switched on"}