{"version":"2.1.285","anchor":"hipaa-policy-gains-allow-bundled-skills-requirement","canonical_anchor":"hipaa-policy-gains-allow-bundled-skills-requirement","heading":"HIPAA organisation policy can block bundled skills","tier":"notice","area":"Skills","url":"https:\/\/changelogs.core-directive.com\/v\/2.1.285\/e\/hipaa-policy-gains-allow-bundled-skills-requirement","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.285","markdown":"### HIPAA organisation policy can block bundled skills\n\nA new organisation policy, allow_bundled_skills, is denied for HIPAA organisations, so bundled skills are not allowed there\n\n**Unclear.** It is not clear how the policy is fetched or exactly what happens to the skills list when it is denied.\n\n**What**\n\nOrganisations can set policies that control what Claude Code is allowed to do. A new policy, `allow_bundled_skills`, covers bundled skills, which are ready-made instruction packs Claude can use. For organisations under the HIPAA policy set (requirement HIPAA-R56), it is denied.\n\nIf Claude Code has no stored copy of the policy to check, it allows bundled skills.\n\n**Why**\n\nIf your organisation is under HIPAA rules, bundled skills will be switched off for you.\n\n- Area: Skills\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}