# Configuring Privacy Policies

Select and customize OpenMed's seven bundled privacy policy profiles for...

- Repository: https://github.com/maziyarpanahi/openmed (5755 stars)
- Category: Data and ML
- License: Apache-2.0
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add maziyarpanahi/openmed --skill configuring-privacy-policies -g -a claude-code -y`
Codex: `npx skills add maziyarpanahi/openmed --skill configuring-privacy-policies -g -a codex -y`
Cursor: `npx skills add maziyarpanahi/openmed --skill configuring-privacy-policies -g -a cursor -y`
Gemini CLI: `npx skills add maziyarpanahi/openmed --skill configuring-privacy-policies -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add maziyarpanahi/openmed`

## Description

Select and customize OpenMed's seven bundled privacy policy profiles for de-identification, and build custom surrogate generators. Use when the user asks which policy fits HIPAA Safe Harbor vs Expert Determination vs GDPR vs PIPEDA vs a research limited dataset vs strict no-leak, wants to pass policy= to deidentify(), needs to keep quasi-identifiers for research, or must register a custom MRN/name/address surrogate provider. Covers the profile-to-use-case map, AnonymizerConfig/Anonymizer for fine control, and register_clinical_provider / register_label_generator. Pairs with OpenMed deidentifying-clinical-text and generating-synthetic-surrogates.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Configuring privacy policies

A **policy profile** is a named bundle of de-identification decisions: which
action (mask/redact/replace/keep) applies to each label, how aggressively
detectors arbitrate, whether the mandatory safety sweep runs, and whether a
reversible mapping is produced. OpenMed ships seven profiles. Pass one by name
to `deidentify(policy=...)` and you get a compliance-aligned default without
hand-wiring 50+ per-label actions. Everything runs **on-device**.

## When to use this skill

Use it to pick the right `policy=` for a regulatory context, to understand what
a profile actually changes, or to go beyond the bundle, keeping quasi-
identifiers for research, or registering a custom surrogate generator (e.g. your
own MRN format).

## Quick start

```python
import openmed

note = "Jane Roe, DOB 1979-04-11, lives in Cambridge MA 02139. SSN 123-45-6789."

# HIPAA Safe Harbor: mask every identifier class.
safe = openmed.deidentify(note, policy="hipaa_safe_harbor")

# GDPR pseudonymization: replace with fakes AND keep a reversible mapping.
gdpr = openmed.deidentify(note, policy="gdpr_pseudonymization")
mapping = gdpr.mapping          # present because the profile sets keep_mapping=True

# Research limited dataset: mask direct identifiers, KEEP quasi-identifiers
# (dates, age, ZIP, geography) so the data stays analytically useful.
lds = openmed.deidentify(note, policy="research_limited_dataset")
```

## The seven bundled profiles

Each profile lives in `openmed/core/policies/<name>.json`. Summary of what each
actually configures:

The rest: https://github.com/maziyarpanahi/openmed/blob/HEAD/skills/configuring-privacy-policies/SKILL.md