# Auditing Safe Harbor Checklist

Verify OpenMed de-identified output against all 18 HIPAA Safe Harbor identifier...

- Repository: https://github.com/maziyarpanahi/openmed (5755 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add maziyarpanahi/openmed --skill auditing-safe-harbor-checklist -g -a claude-code -y`
Codex: `npx skills add maziyarpanahi/openmed --skill auditing-safe-harbor-checklist -g -a codex -y`
Cursor: `npx skills add maziyarpanahi/openmed --skill auditing-safe-harbor-checklist -g -a cursor -y`
Gemini CLI: `npx skills add maziyarpanahi/openmed --skill auditing-safe-harbor-checklist -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add maziyarpanahi/openmed`

## Description

Verify OpenMed de-identified output against all 18 HIPAA Safe Harbor identifier categories and report residual re-identification risk. Use when the user must confirm a note meets HIPAA Safe Harbor (45 CFR 164.514(b)(2)), needs a coverage checklist mapping detected entities to the 18 categories, wants to flag gaps like ages over 89, rare geography, fax vs phone, or biometrics, or asks whether masking was complete. Maps OpenMed CANONICAL_LABELS to the 18 HIPAA classes and uses extract_pii / deidentify to check coverage. Pairs with OpenMed deidentifying-clinical-text and auditing-deidentification-runs.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Auditing against the HIPAA Safe Harbor checklist

The Safe Harbor method (45 CFR 164.514(b)(2)) de-identifies PHI by removing
**18 specific identifier categories** for the individual and their relatives,
employers, and household members, and requires the covered entity to have **no
actual knowledge** that the remainder could re-identify anyone. This skill turns
that legal checklist into a concrete coverage check over OpenMed output: which
of the 18 categories were detected and handled, and where the gaps are.

The full mapping table lives in
[references/safe-harbor-identifiers.md](references/safe-harbor-identifiers.md), all 18 categories, their OpenMed HIPAA class, the matching `CANONICAL_LABELS`,
and per-category cautions. Read it when you need the authoritative cross-walk.

## When to use this skill

Use it after a de-identification run to *prove* coverage, or before release to
decide whether Safe Harbor is even achievable for this text. If the user needs a
signed, retained record of the run, hand off to `auditing-deidentification-runs`.

## Quick start: coverage check

```python
import openmed
from openmed.core.labels import LABEL_TO_HIPAA, HIPAA_SAFE_HARBOR_CLASSES

note = (
    "Patient John Doe (MRN 1234567), age 92, of Smalltown, seen 2024-03-02. "
    "SSN 123-45-6789, phone 617-555-0142."
)

# 1) Detect identifiers (spans only; no rewrite).
detected = openmed.extract_pii(note)

# 2) Roll each detected span up to its HIPAA Safe Harbor class.
covered = set()
for ent in detected.entities:
    canonical = openmed.normalize_label(ent.label)        # -> CANONICAL_LABELS form
    hipaa_class = LABEL_TO_HIPAA.get(canonical)            # -> one of 18 classes
    if hipaa_class:
        covered.add(hipaa_class)

# 3) Report which of the 18 classes were touched and which weren't observed.
missing = sorted(HIPAA_SAFE_HARBOR_CLASSES - covered)
print("covered:", sorted(covered))
print("not observed in this note:", missing)
```

The rest: https://github.com/maziyarpanahi/openmed/blob/HEAD/skills/auditing-safe-harbor-checklist/SKILL.md