# Auditing Part11 Trails

Generates and verifies 21 CFR Part 11-style audit trails, who/what/when, electronic...

- Repository: https://github.com/maziyarpanahi/openmed (5755 stars)
- Category: DevOps
- License: Apache-2.0
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add maziyarpanahi/openmed --skill auditing-part11-trails -g -a claude-code -y`
Codex: `npx skills add maziyarpanahi/openmed --skill auditing-part11-trails -g -a codex -y`
Cursor: `npx skills add maziyarpanahi/openmed --skill auditing-part11-trails -g -a cursor -y`
Gemini CLI: `npx skills add maziyarpanahi/openmed --skill auditing-part11-trails -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add maziyarpanahi/openmed`

## Description

Generates and verifies 21 CFR Part 11-style audit trails, who/what/when, electronic signatures, and tamper-evidence, for OpenMed pipelines in GxP and clinical-trial (GCP) settings. Use when the user runs OpenMed in a regulated/validated environment and needs an attributable, time-stamped, tamper-evident record of each processing action, electronic-signature manifestations, or computer-system-validation (CSV) evidence. Trigger keywords: 21 CFR Part 11, Part 11, audit trail, electronic signature, e-signature, GxP, GCP, GLP, GMP, CSV, computer system validation, data integrity, ALCOA, tamper-evident, contemporaneous. Pairs adjacent to OpenMed: maps directly onto OpenMed deidentify(audit=True) -> signed AuditReport with .sign(key)/.verify(key), whose repro_hash + HMAC give the tamper-evidence and attribution Part 11 expects. This is a compliance-enablement aid, not a validation certification.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Auditing 21 CFR Part 11 trails for OpenMed pipelines

In FDA-regulated **GxP** work (GCP clinical trials, GLP, GMP) any electronic
record used to support a regulatory decision must meet **21 CFR Part 11**: it has
to be **attributable** (who), **contemporaneous and time-stamped** (when),
describe **what** changed, be **tamper-evident**, and, where a signing event
occurs, carry a controlled **electronic signature**. These map onto the
**ALCOA+** data-integrity expectations (Attributable, Legible, Contemporaneous,
Original, Accurate, +Complete/Consistent/Enduring/Available).

OpenMed's `deidentify(..., audit=True)` already emits a deterministic,
**PHI-free `AuditReport`** that you can `.sign()` (HMAC-SHA256) and later
`.verify()`. That gives you the *tamper-evidence* and *attribution* primitives;
this skill wraps them in the who/when/what/e-signature envelope Part 11 wants.

This is a **compliance-enablement aid**. Part 11 compliance also requires
validated systems (CSV), SOPs, and access controls that live outside any single
library, a QA/validation lead signs off.

## When to use

- OpenMed runs inside a validated/GxP environment and each run must leave an
  attributable, tamper-evident record.
- You need to wrap an OpenMed `AuditReport` with **who/when/what** + an
  **e-signature manifestation** (meaning, signer, timestamp).
- You must **verify** a stored trail hasn't been altered, or produce CSV evidence
  for an inspection.

## How OpenMed's AuditReport maps to Part 11

The rest: https://github.com/maziyarpanahi/openmed/blob/HEAD/skills/auditing-part11-trails/SKILL.md