# Enforcing Nophi Logging

Add a logging and telemetry guard that scrubs or blocks PHI from logs, traces, and...

- Repository: https://github.com/maziyarpanahi/openmed (5755 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-31
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add maziyarpanahi/openmed --skill enforcing-nophi-logging -g -a claude-code -y`
Codex: `npx skills add maziyarpanahi/openmed --skill enforcing-nophi-logging -g -a codex -y`
Cursor: `npx skills add maziyarpanahi/openmed --skill enforcing-nophi-logging -g -a cursor -y`
Gemini CLI: `npx skills add maziyarpanahi/openmed --skill enforcing-nophi-logging -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add maziyarpanahi/openmed`

## Description

Add a logging and telemetry guard that scrubs or blocks PHI from logs, traces, and error reports around an OpenMed deployment. Use when the user wants a Python logging.Filter that redacts protected health information before records are emitted, wants to keep PHI out of OpenTelemetry spans or error trackers, needs structured no-PHI log fields, or is worried that logs and stack traces are leaking patient data. Trigger on \"scrub logs\", \"redact PHI from logs\", \"no-PHI logging\", \"logging filter\", \"telemetry redaction\", \"logs leaking patient data\", or \"OpenTelemetry redaction\" in an OpenMed deployment.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Enforcing No-PHI Logging

Logs are a top breach vector: a clinical string lands in a log line, gets shipped
to a centralized log store and an error tracker, and is now PHI sitting outside
the de-id boundary. OpenMed's local-first stance says *no raw PHI in logs, caches,
or error reports*, this skill enforces it with a redaction guard that runs
**before** any record is emitted.

## When to use this skill

- An OpenMed service logs request text, model output, or exception messages.
- You ship logs/traces to a centralized store or error tracker (Sentry, ELK).
- You need a `logging.Filter` (or OTel processor) that redacts PHI pre-emit.
- You want structured, no-PHI log fields (offsets, hashes, counts) for debugging.

## Quick start, a redacting logging.Filter

```python
import logging
import re
import openmed

# Cheap regex pre-filter for the highest-risk structured identifiers. This runs
# on every record, so keep it fast; the model is the fallback for free-text PHI.
_FAST_PATTERNS = [
    (re.compile(r"\b\d{3}-\d{2}-\d{4}\b"), "[SSN]"),
    (re.compile(r"\b\d{16}\b"), "[CARD]"),
    (re.compile(r"\b[\w.+-]+@[\w-]+\.[\w.-]+\b"), "[EMAIL]"),
    (re.compile(r"\b(?:\+?\d[\d().\-\s]{7,}\d)\b"), "[PHONE]"),
]

class NoPHIFilter(logging.Filter):
    """Redact PHI from a log record before it is emitted. Fail closed."""

    def __init__(self, model_name: str | None = None, use_model: bool = True):
        super().__init__()
        self.model_name = model_name
        self.use_model = use_model

The rest: https://github.com/maziyarpanahi/openmed/blob/HEAD/skills/enforcing-nophi-logging/SKILL.md