checking-hipaa-compliance
Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information, needs a pre-deployment compliance review, wants to know which administrative, physical, and technical safeguards apply, is scoping a Business Associate Agreement, or must document minimum-necessary and de-identification controls. Trigger keywords: HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysi
npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Checking HIPAA compliance before deploying on PHI Before any pipeline touches **protected health information (PHI)**, the operating entity (a covered entity or its business associate) must have the HIPAA **Privacy Rule** and **Security Rule** safeguards in place. This skill walks a concrete pipeline against those requirements and emits a **gap report**: which controls are met, which are missing, and where OpenMed's on-device de-identification and signed audit trail satisfy a requirement. The full control list — administrative, physical, and technical safeguards with their 45 CFR citations — is in [references/hipaa-checklist.md](references/hipaa-checklist.md). This skill is a **self-assessment aid**, not legal advice; a Privacy Officer signs off on compliance. ## When to use - You are about to deploy OpenMed (or any pipeline) on real PHI and need a go/no-go compliance review. - You must document **safeguards** and **minimum-necessary** controls for an audit, a BAA, or a security questionnaire. - You want to decide between **Safe Harbor** and **Expert Determination** de-identification and record the rationale. - You need a reproducible gap report you can hand to a Privacy/Security
- When to use
- The two paths to "no longer PHI"
- Quick start
- Workflow
- Hand-off to / from OpenMed
- Edge cases & gotchas
- Standards & references
What does the checking-hipaa-compliance skill do?
Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information, needs a pre-deployment compliance review, wants to know which administrative, physical, and technical safeguards apply, is scoping a Business Associate Agreement, or must document minimum-necessary and de-identification controls. Trigger keywords: HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysi
How do I install it?
Run `npx skills add maziyarpanahi/openmed --skill checking-hipaa-compliance --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From maziyarpanahi/openmed, a repository with 4,851 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.