HIPAA Compliance & De-identification

A clinical de-identification pipeline capable of detecting and removing 30+ Protected Health Information (PHI) entity types from clinical text. The skill provides both masked output (replacing PHI with category tags like [PATIENT_NAME]) and obfuscated output (replacing PHI with realistic synthetic values) for HIPAA Safe Harbor and Expert Determination compliance. All processing runs locally with data never leaving the secure environment.

Quick Install

npx skills add Open-Medica/open-medical-skills --skill hipaa-compliance-checker

What It Does

• 30+ PHI entity detection: Identifies all 18 HIPAA Safe Harbor identifiers plus additional clinical entities including patient names, dates of birth, medical record numbers, SSNs, phone numbers, email addresses, IP addresses, device identifiers, biometric identifiers, geographic subdivisions smaller than a state, and account numbers
• Dual output modes: Provides masked mode (PHI replaced with bracketed category labels for audit trails) and obfuscated mode (PHI replaced with realistic synthetic data for research datasets that need to retain statistical properties)
• Context-aware detection: Uses clinical NLP to distinguish between PHI and non-PHI uses of the same entity type (e.g., differentiating "Dr. Smith ordered the test" as a provider name from "the patient's brother Smith" as a relative identifier requiring de-identification)
• Batch processing: Processes individual clinical notes or entire document collections, producing de-identified output alongside a PHI detection report with entity counts and confidence scores
• Compliance reporting: Generates audit-ready reports documenting what PHI was detected, what action was taken, and the confidence level for each detection, supporting compliance officer review workflows

Clinical Use Cases