hipaa-compliance-auditor

Clinical-grade PII/PHI detection and de-identification for healthcare text data. Scans all 18 HIPAA identifier categories with confidence scoring, generates audit logs, supports custom regex patterns, and produces de-identified output while preserving document structure.

Quality

63%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./scientific-skills/Academic Writing/hipaa-compliance-auditor/SKILL.md

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is actionable with a well-sequenced, checkpointed workflow that aligns with the bundled script, but it is notably verbose and redundantly structured, and its progressive disclosure is undermined by a mislabeled reference path, a dangling reference, and inline content that should be split out.

Suggestions

Collapse the duplicated Quick Check / Audit-Ready Commands / Usage sections into one concise command-and-API block, and remove generic boilerplate (Lifecycle, Evaluation Criteria, Prerequisites, Response Template) that adds no skill-specific value.

Fix reference paths: change 'references/hipaa_safe_harbor_guide.pdf' to the actual '.md' file and remove or create 'references/test_cases/' so every listed reference resolves.

Move the inlined 18-identifier category list, output-format spec, audit-log JSON schema, and technical architecture into reference files, keeping SKILL.md an overview with one-level-deep, clearly signaled links.

Dimension	Reasoning	Score
Conciseness	Noticeably verbose with redundant sections — Quick Check and Audit-Ready Commands both repeat 'python -m py_compile scripts/main.py', the Usage/Python API section duplicates Workflow Step 3, and Lifecycle/Evaluation Criteria/Prerequisites/Response Template boilerplate adds padding Claude does not need.	2 / 5
Actionability	Provides concrete executable commands and a Python API whose surface matches the actual bundle (HIPAAAuditor().deidentify() returns cleaned_text/detected_pii; argparse flags match the Parameters table), copy-paste ready with only minor gaps.	4 / 5
Workflow Clarity	A clear 5-step sequence with explicit checkpoints ('Checkpoint 1', 'If neither input provided', 'If de-identification fails') and a review/QA step; validation is advisory rather than an enforced gate, leaving a minor gap below the explicit feedback-loop anchor.	4 / 5
Progressive Disclosure	References real bundle files (pii_patterns.json, requirements.txt, hipaa_safe_harbor_guide.md) but mislabels the guide as .pdf, references a non-existent references/test_cases/ directory, and inlines large blocks (18-category list, full output format, audit JSON, architecture) that belong in separate reference files.	3 / 5
	Total	13 / 20 Passed

Description

71%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and distinct, clearly articulating concrete HIPAA de-identification capabilities. Its main weakness is the missing explicit 'Use when...' trigger guidance, which caps completeness at 3 despite otherwise strong specificity.

Suggestions

Add an explicit 'Use when...' trigger clause naming natural phrases a user would say (e.g., 'Use when the user mentions HIPAA de-identification, redacting PHI from clinical text, or anonymizing healthcare records').

Include common synonyms users might naturally say ('redact', 'anonymize', 'PHI removal') alongside 'detection' and 'de-identification' to broaden trigger-term coverage.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Scans all 18 HIPAA identifier categories with confidence scoring, generates audit logs, supports custom regex patterns, and produces de-identified output while preserving document structure' — with comprehensive coverage.	5 / 5
Completeness	Has a clear 'what' (detects and de-identifies PII/PHI) but no explicit 'Use when...' trigger clause, so per the judging guidelines completeness is capped at 3 with 'when' only weakly implied by 'for healthcare text data'.	3 / 5
Trigger Term Quality	Strong natural terms ('PII/PHI detection', 'de-identification', 'healthcare text data', 'HIPAA', 'audit logs') but missing common synonyms like 'redact', 'anonymize', and file-context triggers a user might naturally say.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear HIPAA/healthcare-PII niche with minimal conflict risk, with only minor overlap against general anonymization skills.	4 / 5
	Total	16 / 20 Passed

Validation

87%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 14 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
referenced_paths_exist	Referenced path issues: 2 missing	Warning

	Total	14 / 16 Passed

Repository: aipoch/medical-research-skills
Path: scientific-skills/Academic Writing/hipaa-compliance-auditor/SKILL.md
Commit: 63c61d3

Reviewed: 9 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.