HIPAA Shield.
Catch PHI before it leaks.
A free Chromium browser extension that warns when Protected Health Information is being typed or pasted into a browser form — especially consumer AI chat interfaces that do not sign HIPAA Business Associate Agreements at their default tier. 100% client-side detection. Zero telemetry. Ever.
Free · Open Source · MIT Licensed · Works on Chrome, Edge, Brave, Arc, Opera, Vivaldi
Sample detection
What a staff member sees the moment PHI is caught.
A staff member attempts to paste patient data into an AI chat form. The extension intercepts before the request leaves the browser and shows a warning tied to the specific rule that fired, the destination site, and the BAA state of that destination.
Detected element
Social Security Number
XXX-XX-XXXX · pattern match · Luhn-adjacent
High severity
Destination
Field is inside chat.openai.com
No HIPAA Business Associate Agreement in place.
Suggested action
Override is logged locally so the workforce sanction record can be reconstructed if needed.
Regulatory basis
Under 45 CFR §164.308(a)(1)(ii)(C), covered entities must apply appropriate sanctions to workforce members who fail to comply with security policies and procedures. Shield prevents the disclosure the sanction would follow — catching the paste before it becomes a reportable incident, and preserving a local override log if the workforce member proceeds anyway.
Sample data. The live modal populates with the rule that actually fired, the current destination host, and the current BAA lookup result.
The problem
Staff paste patient data into ChatGPT every day. The browser is where the disclosure happens.
A medical assistant pastes a chart note into ChatGPT to summarize. A biller drafts an appeal letter with claim details. A front desk coordinator cleans up a sensitive patient email. Nobody flagged any of it as a problem. It didn't feel like a breach — it felt like being resourceful.
Under HIPAA, every one of those moments is a potentially reportable disclosure to a third party without a Business Associate Agreement. The major consumer AI chat tools do not sign BAAs at their default tier. The paste is the breach.
The intervention has to happen at the moment of the choice, not in retrospect during an audit. That's the browser. That's what HIPAA Shield does.
What it detects
Eight detection rules. Each toggleable.
| Rule | Severity | Pattern |
|---|---|---|
| Social Security Number | high | XXX-XX-XXXX format with prefix validation |
| Date of birth | high | MM/DD/YYYY 1900–2099 |
| Credit card number | high | Visa/MC/Amex/Discover with Luhn check |
| Medical Record Number (MRN) | high | MRN-prefixed identifiers |
| Phone number | medium | Standard US phone formats |
| Email address | medium | Standard email format |
| ICD-10 diagnosis code | low | Standard ICD-10 format |
| Diagnosis terms | low | Clinical keyword patterns |
Where it works
Any text input on any website.
The extension scans every text input, textarea, and editable field on every page. It's especially useful for:
- AI chat tools where staff paste questions about real patients
- Webmail compose windows where attachments and addresses can leak PHI
- Customer support and CRM forms used for patient outreach
- Vendor portals, ticketing systems, and intake forms
- Any text input, textarea, or contenteditable field on any website
Privacy
100% client-side. Zero network requests.
The extension does not collect, transmit, store on any server, or share any data. Period. Every check happens inside your browser, on your device.
No telemetry. No analytics. No error reporting. No usage tracking. The manifest declares zero host_permissions and the source code contains zero fetch calls. You can audit this yourself.
FAQ
Frequently asked questions
Is HIPAA Shield really free?
Yes. The extension is open source under the MIT license. There is no premium tier, no paid plan, and no upsell. Patient Protect publishes it as a free contribution to closing the casual-disclosure breach category.
Does the extension send my data anywhere?
No. The extension makes zero network requests, contains zero telemetry, and never transmits page content, form contents, detection results, or any other data. All detection runs entirely in your browser. The manifest is public in the Chrome Web Store listing and the full source is on GitHub — verify it yourself at github.com/patient-protect/hipaa-shield.
What does it detect?
Social Security Numbers, dates of birth, credit card numbers (Luhn-validated), Medical Record Numbers, ICD-10 codes, and clinical diagnosis terms. Phone numbers and email addresses are detected but disabled by default to reduce noise. Each rule is toggleable.
Will it work on Firefox or Edge?
It works on any Chromium-based browser today: Chrome, Edge, Brave, Arc, Opera, Vivaldi. A Firefox port is in progress and will ship when Manifest V3 compatibility is finalized.
Is this a replacement for our compliance program?
No. The extension catches casual disclosures at the moment of entry — particularly the 'let me just paste this into ChatGPT' use cases that drive the fastest-growing breach category. It is not a substitute for workforce training, a written AI-use policy, BAAs, or platform-level data loss prevention.
Can I customize what it detects?
Yes. Click the extension icon to open the settings popup, then toggle individual detection rules on or off. Settings are stored locally in your browser via chrome.storage.local and never transmitted.
One free tool in a larger toolkit.
HIPAA Shield is one of 15+ free resources in Patient Protect’s HIPAA Foundation, published to close the compliance and security gap for independent healthcare practices. See the full collection — risk assessments, breach intelligence, training modules, an open dataset, and more.
Part of the HIPAA Foundation · 15+ free tools
See the full collectionPrevent disclosure
Shield catches the casual disclosure at the keystroke. The platform prevents the cascade of policy, training, and BAA gaps that made the disclosure possible in the first place.
Next in the sequence
ePHI Data Flow MapperProtection at the moment of the decision — not another document explaining what should have happened afterward.
From free tools to a running program
Ready to start the real work?
The browser extension catches the casual disclosure. The Patient Protect platform keeps the whole compliance program running between assessments — continuous monitoring, BAA tracking, audit-log review, workforce training enforcement, and incident response.
Free tools stay free — no account needed. The 14-day platform trial asks for a card for identity verification; no charge before day 14, cancel any time.