HIPAA Shield — PHI Detection for Browsers

HIPAA Shield warns when Protected Health Information (PHI) is typed or pasted into browser forms — especially consumer AI chat interfaces that do not sign HIPAA Business Associate Agreements at their default tier. When the extension detects PHI in a text field, a warning banner appears immediately above the input, alerting the user before they hit "send." WHY THIS MATTERS Healthcare staff increasingly paste patient information into consumer AI tools to summarize, rewrite, or draft from. Most of those tools don't qualify as HIPAA-eligible at the consumer tier and may use inputs for training. From the practice's standpoint, every paste is a potentially reportable disclosure under HIPAA's Privacy Rule. The intervention has to happen at the moment of the choice, not in retrospect during an audit. WHAT IT DETECTS The extension detects eight categories of PHI in any input field: • Social Security Numbers (with prefix validation) • Date of birth (MM/DD/YYYY 1900–2099) • Credit card numbers (Visa, Mastercard, Amex, Discover — Luhn-validated) • Medical Record Numbers (MRN-prefixed identifiers) • Phone numbers (US formats) • Email addresses • ICD-10 diagnosis codes • Clinical diagnosis terms Each rule is individually toggleable in the extension popup. SSN, date of birth, credit card, MRN, and ICD-10 are enabled by default. Phone, email, and diagnosis terms are off by default to reduce noise during normal browsing. WHERE IT WORKS The extension scans every text input, textarea, and contenteditable field on every page. It is especially useful in: • Consumer AI chat interfaces where staff paste questions about real patients • Webmail composers where attachments and addresses can leak PHI • Customer support and CRM forms used for patient outreach • Vendor portals, ticketing systems, and intake forms • Any web form, textarea, or rich text editor on any site PRIVACY — 100% CLIENT-SIDE The extension makes zero network requests. No telemetry. No analytics. No error reporting. No usage tracking. • Manifest declares zero host_permissions • Source code contains zero fetch or XMLHttpRequest calls • Detection runs entirely in your browser, on your device • Local storage is used only to remember your rule toggles • No remote code injection — all JavaScript and CSS ships in the extension Full privacy policy: https://patient-protect.com/hipaa-shield/privacy Verify the source: https://github.com/patient-protect/hipaa-shield (MIT license, under 250 lines of detection logic) WHAT IT IS NOT This extension catches casual disclosures at the moment of entry. It is not a substitute…