checking-hipaa-compliance

Runs a HIPAA Privacy and Security Rule checklist over a data pipeline and produces a gap report before deploying OpenMed on PHI. Use when the user is about to process protected health information, needs a pre-deployment compliance review, wants to know which administrative, physical, and technical safeguards apply, is scoping a Business Associate Agreement, or must document minimum-necessary and de-identification controls. Trigger keywords: HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysis, compliance review. Pairs adjacent to OpenMed: the checklist shows where openmed.deidentify and signed audit reports satisfy the de-identification and audit-control requirements. The control list lives in references/hipaa-checklist.md. This is a structured self-assessment aid, not legal advice.

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable compliance skill body with executable code, a sequenced workflow, a real one-level-deep reference, and substantive edge cases. Minor conciseness redundancy and an implicit (rather than inline) remediation loop keep two dimensions at 4 rather than 5.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with a copy-paste code example, sequenced workflow, and high-value edge cases; minor instances of over-explanation (the intro paragraph restates the description, and 'not legal advice' / 'no new business associate' are repeated across sections) that could be trimmed. Not a 3 because the bulk of the content earns its place; not a 5 because of the mild redundancy.	4 / 5
Actionability	Provides a fully executable, copy-paste-ready Quick start using openmed.deidentify with policy/audit flags and report.sign(), plus a concrete gap-detection dict with inline comments — covering the common cases, matching the score-5 anchor.	5 / 5
Workflow Clarity	Six clearly sequenced steps (map data flow, confirm legal basis, run safeguard groups, enforce minimum necessary, record de-id method, emit gap report) backed by a per-control checklist with Met? checkboxes. Not a 5 because the remediate→re-verify feedback loop is implied (edge cases + checklist A11) rather than an explicit inline validate/fix/retry step.	4 / 5
Progressive Disclosure	SKILL.md is a well-signaled overview pointing one level deep to the verified references/hipaa-checklist.md (linked repeatedly), with the full control list appropriately split out and external standards listed separately — easy to navigate, matching the score-5 anchor.	5 / 5
	Total	18 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states what the skill does, when to use it, and the natural trigger keywords a user would say. Coverage is comprehensive and the niche is distinct with negligible conflict risk.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Runs a HIPAA Privacy and Security Rule checklist', 'produces a gap report', 'scoping a Business Associate Agreement', 'document minimum-necessary and de-identification controls' — with comprehensive coverage of the compliance task, matching the score-5 anchor.	5 / 5
Completeness	Clearly answers 'what' ('Runs a HIPAA... checklist... and produces a gap report before deploying OpenMed on PHI') and 'when' via an explicit 'Use when the user is about to process protected health information, needs a pre-deployment compliance review...' clause with concrete trigger phrases, matching the score-5 anchor.	5 / 5
Trigger Term Quality	Explicitly enumerates natural trigger keywords users would say — 'HIPAA, Privacy Rule, Security Rule, 45 CFR 164, PHI, BAA, business associate, minimum necessary, safeguards, Safe Harbor, Expert Determination, gap analysis, compliance review' — including synonyms (BAA/business associate), matching the comprehensive score-5 anchor.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (HIPAA compliance / pre-deployment PHI review) with highly specific triggers (45 CFR 164, BAA, Safe Harbor, Expert Determination) and explicit OpenMed pairing, giving minimal conflict risk with other skills.	5 / 5
	Total	20 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: maziyarpanahi/openmed
Path: skills/checking-hipaa-compliance/SKILL.md
Commit: 80da98c

Reviewed: about 24 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.