{"version":"2.1.323","anchor":"hipaa-credential-withholding-notice-also-covers-a-pending-po","canonical_anchor":"hipaa-credential-withholding-notice-also-covers-a-pending-po","heading":"Credentials are also withheld while an organization's HIPAA policy is still being checked","tier":"notice","area":"Data Retention","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/hipaa-credential-withholding-notice-also-covers-a-pending-po","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Credentials are also withheld while an organization's HIPAA policy is still being checked\n\nClaude Code now withholds its Anthropic credentials from programs it starts while an org's policy decision has not arrived yet\n\n**What**\n\nFor organizations under HIPAA, the US health-privacy law, Claude Code keeps its Anthropic credentials away from two places:\n\n- Child processes, meaning other programs Claude Code starts.\n\n- `${VAR}` expansion in configuration files, where a variable name is replaced by its value.\n\nThis now also applies while the organization's policy decision has not arrived yet. If the check for that decision fails, Claude Code treats the credentials as withheld. The log message now names both reasons.\n\n**Why**\n\nCredentials can now be held back until the policy decision arrives, which could affect what tools and configuration can use them early in startup for some organizations.\n\n- Area: Data Retention\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: org\n- Heads-up: no"}