skills.rest
JustinChaney2023
JustinChaney2023COMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-hipaa

Enforce HIPAA-aligned security controls for local-first transcription and OCR apps.

Updated Aug 27, 2026
Search Tags:#security#HIPAA#threat-modeling#privacy#on-device#audit-logging#data-retention
One-click install
npx skills add https://github.com/JustinChaney2023/orate --skill security-hipaa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-hipaa
Source: https://github.com/JustinChaney2023/orate/tree/main/roles/security-hipaa
Command: npx skills add https://github.com/JustinChaney2023/orate --skill security-hipaa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Implement HIPAA-aligned security, privacy, and compliance controls for a local-first transcription/OCR + form-filling app. Use when designing threat model, data handling, encryption, audit logging, access control, retention, and safe model execution.

Core Features & Use Cases

  • Threat modeling and data classification: Classify all inputs/outputs as PHI by default and identify attack surfaces.
  • Local-first guarantees: Ensure on-device processing for OCR, transcription, and LLM extraction with explicit user opt-in before network egress.
  • Encryption and secrets: Encrypt at rest for local DB, attachments, and derived text; use OS keystore keys when available.
  • Access control: Implement role-based access with automatic lock on idle and protected exports.
  • Audit logging: Log who processed what, when, and export events; avoid logging raw PHI in plaintext.
  • Retention and deletion: Provide configurable retention windows and secure deletion for attachments.
  • Model safety: Pin model hashes, verify downloads, and sandbox inference when possible.

Quick Start

Configure HIPAA-compliant security for a local-first transcription app to ensure on-device processing, encrypted storage, and auditable access.

Frequently Asked Questions about security-hipaa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement HIPAA security controls for an on-device transcription app?▼

HIPAA security controls for an on-device transcription app are implemented by enforcing local-first processing, encrypting data at rest using OS keystore keys, and generating deliverables like threat_model.md and security_controls_checklist.md.

What threat modeling approach is needed for local-first OCR processing of PHI?▼

Threat modeling for local-first OCR processing requires classifying all inputs and outputs as PHI by default, identifying attack surfaces, and ensuring explicit user opt-in before any network egress occurs.

How do I set up audit logging for a HIPAA-compliant transcription app without exposing raw PHI?▼

Audit logging in a HIPAA-compliant transcription app records who processed what data and when, along with export events, while strictly avoiding logging raw PHI in plaintext to maintain compliance.

Can I use OS keystore keys for encrypting local databases and attachments in a local-first app?▼

OS keystore keys can be used for encrypting local databases, attachments, and derived text at rest in a local-first app, providing hardware-backed security when the operating system supports it.

What data retention and deletion policies should a HIPAA-aligned OCR application include?▼

A HIPAA-aligned OCR application should include configurable retention windows for stored data and implement secure deletion procedures for attachments, documented in a retention_policy.md deliverable.

How do I ensure safe model execution for on-device LLM extraction and inference?▼

Safe model execution for on-device LLM extraction involves pinning model hashes, verifying downloads, and sandboxing inference when possible to prevent unauthorized access to PHI data.

Related Skills

Explore More Legal & Compliance Skills→
BAIZ1DBAIZ1D

aws-compliance-checker

Automate AWS configuration validation against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks.

Community
Intermediate
tradermontytradermonty
2.6k

portfolio-manager

Fetch live brokerage holdings via Alpaca MCP Server and generate Markdown portfolio reports.

Community
Advanced
stevengonsalvezstevengonsalvez

use-local-whisper

Switch WhatsApp voice transcription to local whisper.cpp on Apple Silicon.

Community
Intermediate
ROYCE-8425ROYCE-8425
1

healthcare-phi-compliance

Enforce PHI and PII compliance in healthcare applications with data classification, access control, audit trails, and encryption.

Community
Advanced