medical-data-compliance

What problem does it solve?

This Skill prevents Protected Health Information (PHI) from being mishandled in AI-agent workflows by defining strict, enforceable rules for data sharing, storage, encryption, auditability, consent, and patient rights.

Core Features & Use Cases

• PHI handling guardrails: Prohibits sending PHI to external LLM APIs, transcription services, and common communication/storage channels (email/chat/cloud drives) and requires structured logging with field-level redaction.
• Synthetic-only development: Forces the use of synthetic or formally de-identified test data for local development and testing, with explicit rules against checking real or real-derived PHI into fixtures.
• Operational compliance controls: Requires encryption at rest and in transit, mandatory audit events for every read/write, revocable granular consent, and a pre-planned breach response with an reviewed threat model.

Quick Start

Apply the medical-data-compliance skill before designing or updating any feature that could touch patient data, and verify that the workflow uses synthetic/de-identified inputs while enforcing encryption, consent checks, and auditable access.