risk-register-synthesis

Run this Skill after executing source skills like phi-pii-leak-scan and hipaa-compliance-audit. It aggregates their output files from ContextFiles2/Library/Sessions, scores each finding for likelihood and impact, and produces a consolidated register in Markdown or JSON.

Section 164.308(a)(1)(ii)(A) requires an accurate and thorough assessment of risks to the confidentiality, integrity, and availability of ePHI. A simple pass/fail checklist is insufficient; each finding needs quantified likelihood, impact, and a risk score.

Likelihood ranges from 1 (rare, requires physical access) to 5 (exploitable without authentication). Impact ranges from 1 (no PHI exposure) to 5 (clinical data breach with patient harm). Risk score equals likelihood multiplied by impact.

The synthesis notes which skills have no output files and recommends running them. Missing inputs do not block the register; it proceeds with whatever findings exist in the sessions directory.

Findings are deduplicated by root cause rather than by finding ID. For example, unencrypted PHI flagged by both phi-pii-leak-scan and hipaa-compliance-audit becomes a single risk register entry.

Yes. The output format aligns with SOC 2 Trust Service Criteria CC3.2, CC3.3, and CC3.4 for risk assessment processes, so one register can serve both HIPAA and SOC 2 documentation requirements.