Set up an OpenMed de-identification policy

Use this skill before a de-identification pipeline when the privacy decisions are not already recorded. It creates a small policy document; it does not inspect, transform, upload, or retain clinical data. The setup is local-first, deterministic, and has no mandatory network call.

The output is a draft configuration contract, not a compliance certification, legal opinion, or guarantee of de-identification. A human must review and approve the draft before it controls a run.

When to use this skill

Use it when a project needs to turn implicit privacy choices into a reviewable DEID-POLICY.md file. Use the focused de-identification skills afterward to apply or audit the selected policy.

Do not use this skill to collect a note, dataset row, identifier, model output, secret, credential, or any other source payload. The setup questions accept policy choices only. Keep logs, exceptions, reports, and fixtures free of raw sensitive values.

Bounded decision contract

Collect these five decisions, one at a time. Do not invent a sixth field or silently choose a value. The value written to the artifact must be the lowercase canonical value in the right-hand column.

Decision	Bounded choices (canonical value)
Jurisdiction or operating context	us, eu, canada, research, organization-defined
Recall floor	0.90, 0.95, 0.99
Surrogate strategy	mask, remove, replace, hash
Model policy	local-preinstalled, local-user-supplied, rules-only
Audit location	separate-local-directory, controlled-artifact-store, no-retention