HIPAA Safe Harbor Coverage Audit

What it does

When your agent uses it

• Confirming a de-identified note meets HIPAA Safe Harbor before release
• Mapping detected entities to the 18 identifier categories
• Flagging gaps such as ages over 89, rare locations or fax numbers
• Deciding whether Safe Harbor is achievable for a given text

Example prompts

• “Run a Safe Harbor coverage check on the de-identified discharge note in ./notes/discharge.txt.”
• “List which of the 18 HIPAA identifier categories our masking missed in this report.”
• “Check this note for ages over 89 and rare geography that could still identify the patient.”

Requirements

• Python with the `openmed` package

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1De-identify with a Safe Harbor profile
2. 2Map detected spans to the 18 classes via LABEL_TO_HIPAA (as above).
3. 3Walk the checklist in
4. 4Assess residual risk. Run audit=True and read residual_risk
5. 5Record the "no actual knowledge" judgment. A human must sign off that the

What it can do on your machine

Read from SKILL.md and the folder at commit 34d7b8c. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are python).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • ecfr.gov
  • hhs.gov

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

HIPAA Safe Harbor Coverage Audit loads about 1.7k tokens when it runs, and up to ~3k if it reads all its reference files. Until then it costs about 159 tokens; SKILL.md has 574 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~159

When it runs · the whole SKILL.md, loaded when a task matches

~1.7k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from maziyarpanahi/openmed at commit 34d7b8c, republished under its Apache-2.0 licence (© maziyarpanahi). 574 words, ~1,658 tokens.

name

auditing-safe-harbor-checklist

description

Verify OpenMed de-identified output against all 18 HIPAA Safe Harbor identifier categories and report residual re-identification risk. Use when the user must confirm a note meets HIPAA Safe Harbor (45 CFR 164.514(b)(2)), needs a coverage checklist mapping detected entities to the 18 categories, wants to flag gaps like ages over 89, rare geography, fax vs phone, or biometrics, or asks whether masking was complete. Maps OpenMed CANONICAL_LABELS to the 18 HIPAA classes and uses extract_pii / deidentify to check coverage. Pairs with OpenMed deidentifying-clinical-text and auditing-deidentification-runs.

license

Apache-2.0

metadata.project

OpenMed

metadata.category

de-identification

metadata.pairs

after

metadata.version

1.0

import openmed
from openmed.core.labels import LABEL_TO_HIPAA, HIPAA_SAFE_HARBOR_CLASSES

note = (
    "Patient John Doe (MRN 1234567), age 92, of Smalltown, seen 2024-03-02. "
    "SSN 123-45-6789, phone 617-555-0142."
)

# 1) Detect identifiers (spans only; no rewrite).
detected = openmed.extract_pii(note)

# 2) Roll each detected span up to its HIPAA Safe Harbor class.
covered = set()
for ent in detected.entities:
    canonical = openmed.normalize_label(ent.label)        # -> CANONICAL_LABELS form
    hipaa_class = LABEL_TO_HIPAA.get(canonical)            # -> one of 18 classes
    if hipaa_class:
        covered.add(hipaa_class)

# 3) Report which of the 18 classes were touched and which weren't observed.
missing = sorted(HIPAA_SAFE_HARBOR_CLASSES - covered)
print("covered:", sorted(covered))
print("not observed in this note:", missing)

© maziyarpanahi, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in skills/auditing-safe-harbor-checklist of maziyarpanahi/openmed.

• SKILL.md
• references/safe-harbor-identifiers.md

Open the folder on GitHubat commit 34d7b8c