About Complint

Complint is a HIPAA compliance linter for GitHub pull requests. The name is a portmanteau of “compliance” and “lint.”

The Problem

Healthcare engineering teams sign Business Associate Agreements that make them legally responsible for protecting patient data in their code. But HIPAA compliance is complex, the regulatory text is dense, and most developers have never read 45 CFR §164.

The result: violations slip into code and get discovered months later during an OCR audit, a security incident, or a compliance review. By then the damage is done — the code shipped, patients were affected, and the fix is expensive.

What Complint Does

Complint reviews every pull request for HIPAA compliance violations before it merges. It reads the diff, retrieves relevant regulatory context from an embedded knowledge base of 45 CFR Part 164, and uses AI to identify code patterns that would put the organization out of compliance.

When it finds a violation, it posts an inline comment on the exact line of code — with the severity, the specific HIPAA section being violated, an explanation of why it matters, and a suggested fix the developer can apply with one click.

Install the GitHub App, enable it on your repos, and the next PR gets reviewed automatically.

How It Works

  • 1.A developer opens or updates a pull request on a connected repository.
  • 2.Complint receives the webhook, fetches the diff, and filters for files relevant to HIPAA (based on code patterns, file paths, and optional per-repo configuration).
  • 3.For each relevant file, it retrieves regulatory context from an embedded HIPAA knowledge base using vector similarity search.
  • 4.Claude analyzes the code against the retrieved regulations and produces structured findings with HIPAA section citations.
  • 5.A six-stage hallucination guard validates every finding before it ships — checking line numbers, citation accuracy, confidence levels, and filtering out absence-based false positives.
  • 6.Validated findings are posted as inline PR comments with severity badges, explanations, and one-click suggested fixes.

What We Don't Do

Complint is advisory only. It does not push commits, block merges, or modify your code. The developer always decides what to fix and when. We also don't store your source code — diffs are fetched, analyzed, and discarded. Only finding metadata (severity, HIPAA section, file path, line number) is persisted.

Built By

Complint is built by a solo founder who saw healthcare teams struggle with the gap between “we signed a BAA” and “our code is actually compliant.” The goal is to make HIPAA compliance so effortless that developers don't think about it — it just happens on every PR, automatically.