Checking Hipaa Compliance
Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a...
Install
npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance -g -a claude-code -y- Repository
- maziyarpanahi/openmed5.8k
- Category
- Security
- Updated
- 4d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 1,769 tokens
- Runs scripts
- No, instructions only
What it does
Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information, needs a pre-deployment compliance review, wants to know which administrative, physical, and technical safeguards apply, is scoping a Business Associate Agreement, or must document minimum-necessary and de-identification controls. Trigger keywords: HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysis, compliance review. Pairs adjacent to OpenMed: the checklist shows where openmed.deidentify and signed audit reports satisfy the de-identification and audit-control requirements. The control list lives in references/hipaa-checklist.md. This is a structured self-assessment aid, not legal advice.
Checking HIPAA compliance before deploying on PHI
Before any pipeline touches protected health information (PHI), the operating entity (a covered entity or its business associate) must have the HIPAA Privacy Rule and Security Rule safeguards in place. This skill walks a concrete pipeline against those requirements and emits a gap report: which controls are met, which are missing, and where OpenMed's on-device de-identification and signed audit trail satisfy a requirement.
The full control list, administrative, physical, and technical safeguards with their 45 CFR citations, is in references/hipaa-checklist.md. This skill is a self-assessment aid, not legal advice; a Privacy Officer signs off on compliance.
When to use
- You are about to deploy OpenMed (or any pipeline) on real PHI and need a go/no-go compliance review.
- You must document safeguards and minimum-necessary controls for an audit, a BAA, or a security questionnaire.
- You want to decide between Safe Harbor and Expert Determination de-identification and record the rationale.
- You need a reproducible gap report you can hand to a Privacy/Security Officer.
The two paths to "no longer PHI"
HIPAA recognizes two de-identification methods (45 CFR 164.514):
- Safe Harbor, remove all 18 identifier categories and have no actual knowledge the result can re-identify. Deterministic, the common path.
- Expert Determination, a qualified statistician certifies "very small" re-identification risk. Used when you must keep some quasi-identifiers.
OpenMed's deidentify(..., policy="hipaa_safe_harbor") targets the Safe Harbor
identifier set on-device, and deidentify(..., audit=True) produces a signed,
PHI-free AuditReport that documents what was removed, the evidence a Safe
Harbor attestation and a Security Rule audit control both want.
Quick start
import openmed
