Auditing Part11 Trails
Generates and verifies 21 CFR Part 11-style audit trails, who/what/when, electronic...
Install
npx skills add maziyarpanahi/openmed --skill auditing-part11-trails -g -a claude-code -y- Repository
- maziyarpanahi/openmed5.8k
- Category
- DevOps
- Updated
- 4d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 1,953 tokens
- Runs scripts
- No, instructions only
What it does
Generates and verifies 21 CFR Part 11-style audit trails, who/what/when, electronic signatures, and tamper-evidence, for OpenMed pipelines in GxP and clinical-trial (GCP) settings. Use when the user runs OpenMed in a regulated/validated environment and needs an attributable, time-stamped, tamper-evident record of each processing action, electronic-signature manifestations, or computer-system-validation (CSV) evidence. Trigger keywords: 21 CFR Part 11, Part 11, audit trail, electronic signature, e-signature, GxP, GCP, GLP, GMP, CSV, computer system validation, data integrity, ALCOA, tamper-evident, contemporaneous. Pairs adjacent to OpenMed: maps directly onto OpenMed deidentify(audit=True) -> signed AuditReport with .sign(key)/.verify(key), whose repro_hash + HMAC give the tamper-evidence and attribution Part 11 expects. This is a compliance-enablement aid, not a validation certification.
Auditing 21 CFR Part 11 trails for OpenMed pipelines
In FDA-regulated GxP work (GCP clinical trials, GLP, GMP) any electronic record used to support a regulatory decision must meet 21 CFR Part 11: it has to be attributable (who), contemporaneous and time-stamped (when), describe what changed, be tamper-evident, and, where a signing event occurs, carry a controlled electronic signature. These map onto the ALCOA+ data-integrity expectations (Attributable, Legible, Contemporaneous, Original, Accurate, +Complete/Consistent/Enduring/Available).
OpenMed's deidentify(..., audit=True) already emits a deterministic,
PHI-free AuditReport that you can .sign() (HMAC-SHA256) and later
.verify(). That gives you the tamper-evidence and attribution primitives;
this skill wraps them in the who/when/what/e-signature envelope Part 11 wants.
This is a compliance-enablement aid. Part 11 compliance also requires validated systems (CSV), SOPs, and access controls that live outside any single library, a QA/validation lead signs off.
When to use
- OpenMed runs inside a validated/GxP environment and each run must leave an attributable, tamper-evident record.
- You need to wrap an OpenMed
AuditReportwith who/when/what + an e-signature manifestation (meaning, signer, timestamp). - You must verify a stored trail hasn't been altered, or produce CSV evidence for an inspection.
