# Checking Hipaa Compliance

Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a...

- Repository: https://github.com/maziyarpanahi/openmed (5755 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance -g -a claude-code -y`
Codex: `npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance -g -a codex -y`
Cursor: `npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance -g -a cursor -y`
Gemini CLI: `npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add maziyarpanahi/openmed`

## Description

Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information, needs a pre-deployment compliance review, wants to know which administrative, physical, and technical safeguards apply, is scoping a Business Associate Agreement, or must document minimum-necessary and de-identification controls. Trigger keywords: HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysis, compliance review. Pairs adjacent to OpenMed: the checklist shows where openmed.deidentify and signed audit reports satisfy the de-identification and audit-control requirements. The control list lives in references/hipaa-checklist.md. This is a structured self-assessment aid, not legal advice.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Checking HIPAA compliance before deploying on PHI

Before any pipeline touches **protected health information (PHI)**, the
operating entity (a covered entity or its business associate) must have the
HIPAA **Privacy Rule** and **Security Rule** safeguards in place. This skill
walks a concrete pipeline against those requirements and emits a **gap report**:
which controls are met, which are missing, and where OpenMed's on-device
de-identification and signed audit trail satisfy a requirement.

The full control list, administrative, physical, and technical safeguards with
their 45 CFR citations, is in
[references/hipaa-checklist.md](references/hipaa-checklist.md). This skill is a
**self-assessment aid**, not legal advice; a Privacy Officer signs off on
compliance.

## When to use

- You are about to deploy OpenMed (or any pipeline) on real PHI and need a
  go/no-go compliance review.
- You must document **safeguards** and **minimum-necessary** controls for an
  audit, a BAA, or a security questionnaire.
- You want to decide between **Safe Harbor** and **Expert Determination**
  de-identification and record the rationale.
- You need a reproducible gap report you can hand to a Privacy/Security Officer.

## The two paths to "no longer PHI"

HIPAA recognizes two de-identification methods (45 CFR 164.514):

1. **Safe Harbor**, remove all **18 identifier categories** and have no actual
   knowledge the result can re-identify. Deterministic, the common path.
2. **Expert Determination**, a qualified statistician certifies "very small"
   re-identification risk. Used when you must keep some quasi-identifiers.

OpenMed's `deidentify(..., policy="hipaa_safe_harbor")` targets the Safe Harbor
identifier set on-device, and `deidentify(..., audit=True)` produces a signed,
PHI-free `AuditReport` that documents *what* was removed, the evidence a Safe
Harbor attestation and a Security Rule audit control both want.

## Quick start

```python
import openmed

The rest: https://github.com/maziyarpanahi/openmed/blob/HEAD/skills/checking-hipaa-compliance/SKILL.md