You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
Data RetentionArea: what it touches
ImprovementsKind: in v2.1.323,
ImprovementsSection of the release
What
For organizations under HIPAA, the US health-privacy law, Claude Code keeps its Anthropic credentials away from two places:
Child processes, meaning other programs Claude Code starts.
${VAR} expansion in configuration files, where a variable name is replaced by its value.
This now also applies while the organization's policy decision has not arrived yet. If the check for that decision fails, Claude Code treats the credentials as withheld. The log message now names both reasons.
Why
Credentials can now be held back until the policy decision arrives, which could affect what tools and configuration can use them early in startup for some organizations.
