checking-hipaa-compliance

Checking HIPAA compliance before deploying on PHI

Before any pipeline touches protected health information (PHI), the operating entity (a covered entity or its business associate) must have the HIPAA Privacy Rule and Security Rule safeguards in place. This skill walks a concrete pipeline against those requirements and emits a gap report: which controls are met, which are missing, and where OpenMed's on-device de-identification and signed audit trail satisfy a requirement.

The full control list — administrative, physical, and technical safeguards with their 45 CFR citations — is in references/hipaa-checklist.md. This skill is a self-assessment aid, not legal advice; a Privacy Officer signs off on compliance.

When to use

• You are about to deploy OpenMed (or any pipeline) on real PHI and need a go/no-go compliance review.
• You must document safeguards and minimum-necessary controls for an audit, a BAA, or a security questionnaire.
• You want to decide between Safe Harbor and Expert Determination de-identification and record the rationale.
• You need a reproducible gap report you can hand to a Privacy/Security Officer.

The two paths to "no longer PHI"

HIPAA recognizes two de-identification methods (45 CFR 164.514):

1. Safe Harbor — remove all 18 identifier categories and have no actual knowledge the result can re-identify. Deterministic, the common path.
2. Expert Determination — a qualified statistician certifies "very small" re-identification risk. Used when you must keep some quasi-identifiers.

OpenMed's deidentify(..., policy="hipaa_safe_harbor") targets the Safe Harbor identifier set on-device, and deidentify(..., audit=True) produces a signed, PHI-free AuditReport that documents what was removed — the evidence a Safe Harbor attestation and a Security Rule audit control both want.

Quick start

import openmed

# A representative record from the pipeline (synthetic — never log real PHI).
sample = "John Doe (MRN 1234567), DOB 1970-01-15, seen 2024-03-02 in Boston."

# 1) De-identify on-device under the Safe Harbor policy.
result = openmed.deidentify(sample, method="replace", policy="hipaa_safe_harbor")
print(result.deidentified_text)        # identifiers removed/surrogated

# 2) Produce the signed, no-PHI audit record for the compliance file.
report = openmed.deidentify(sample, policy="hipaa_safe_harbor", audit=True)
report.sign(b"<release-hmac-key-from-vault>", key_id="hipaa-2026")

# 3) Walk the checklist (see references/hipaa-checklist.md) and record gaps.
controls = {
    "encryption_at_rest": True,
    "encryption_in_transit": True,
    "access_controls_rbac": True,
    "audit_logging": True,          # satisfied in part by the signed AuditReport
    "minimum_necessary": False,     # <-- gap: pipeline pulls full notes
    "baa_in_place": True,
    "deidentification_method": "safe_harbor",
}
gaps = [name for name, ok in controls.items() if not ok]
print("GAPS:", gaps)