openevidence-data-handling
Outlines data classification and retention policies to ensure HIPAA compliance for clinical AI queries.
Install
mkdir -p .claude/skills/openevidence-data-handling && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/5474" && unzip -o skill.zip -d .claude/skills/openevidence-data-handling && rm skill.zipInstalls to .claude/skills/openevidence-data-handling
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Data Handling for OpenEvidence.Key capabilities
- →De-identify clinical query text using regex patterns
- →Validate clinical queries for PHI and length constraints
- →Enforce data retention schedules for clinical evidence
- →Apply AES-256 encryption to PHI and patient-contextualized data
- →Export evidence summaries with post-processing de-identification
How it works
The skill provides functions to sanitize clinical queries by replacing identifiers like MRNs and SSNs with redacted placeholders before transmission. It also enforces data lifecycle policies, including specific retention periods and encryption standards for different clinical data types.
Inputs & outputs
When to use openevidence-data-handling
- →Configuring data retention policies
- →Implementing PHI de-identification
- →Ensuring HIPAA compliance
- →Securing clinical evidence data flows
About this skill
OpenEvidence PHI and Consent Boundary
Overview
Establish whether data may enter OpenEvidence, who authorizes it, and how outputs move into governed systems. Keep inputs minimal, separate observed facts from assumptions, and leave consequential decisions with the named accountable owner.
Prerequisites
- A clearly bounded workflow, accountable clinical owner, and organizational policy
- Current first-party OpenEvidence documentation and applicable institution agreements
- Synthetic or properly authorized minimum-necessary data
Tool Discipline
Use Read, Glob, and Grep to inspect supplied policies, plans, and evidence. Use WebFetch only for current first-party OpenEvidence documentation. Use Write or Edit only when the user requests a named deliverable with an approved destination. Never expose credentials, PHI, recordings, or unrestricted environment output.
Current Contract
- OpenEvidence terms recommend removing identifying information before submission and assign users responsibility for lawful content.
- Covered entities choosing to transmit PHI are governed by the applicable BAA or customer-specific agreement.
- Visits records conversations; required notice and consent depend on law and organizational policy.
Authentication
Use only the official OpenEvidence web/mobile sign-in or an institution-approved access path. Do not invent API keys, OAuth clients, SDK credentials, service accounts, or private endpoints. Never ask a user to reveal a password, session token, cookie, or recovery code.
Instructions
- Classify the workflow, data elements, users, systems, jurisdiction, retention needs, and whether recording occurs.
- Read the current Terms, Privacy Policy, Security page, applicable BAA/MSA, and institutional policy.
- Minimize identifiers and free text; prefer synthetic or de-identified content when patient identity is unnecessary.
- Document authorization, recording notice and consent, role access, approved export destination, and deletion/retention owner.
- Test the workflow with synthetic data before any authorized real-data use.
- Produce a data-flow record with unresolved legal, privacy, security, and clinical review items.
Approval Boundaries
Do not create or share accounts; change access, roles, agreements, consent, retention, or security settings; enter PHI; record a conversation; copy content into another system; contact a patient; make a diagnosis or treatment decision; submit billing; transmit a support packet; run a production pilot; or represent vendor capabilities without explicit approval from the accountable owner. A qualified professional remains responsible for clinical decisions.
Output
Return scope, current first-party evidence and date, data classification, workflow or findings, citations reviewed, assumptions rejected, clinical and governance owners, approval state, unresolved risk, and the exact next action. Redact patient and credential data.
Error Handling
| Condition | Response |
|---|---|
| BAA or policy unavailable | Block PHI use and continue only with synthetic/de-identified data. |
| Consent uncertain | Do not record; route to privacy or legal owner. |
| Output copied to unmanaged tool | Stop propagation, preserve facts, and follow the incident procedure. |
Examples
This compact example shows the minimum reviewable handoff; adapt fields to the approved workflow without adding sensitive data.
Input:
workflow=Visits recording; jurisdiction=known; data=PHI; agreements=pending
Expected handoff:
decision=blocked; synthetic-test=allowed; approvals=privacy+clinical+security
Resources
When not to use it
- →Transmitting PHI without an executed BAA
- →Storing raw clinical queries beyond the 7-day limit
- →Processing queries exceeding the 5000 character limit
Prerequisites
Limitations
- →De-identification relies on regex and may miss patterns
- →Bulk exports are limited to 50 evidence summaries per request
- →Raw clinical queries must be purged within 7 days
How it compares
Unlike standard API integrations, this workflow mandates specific de-identification regex patterns and strict retention schedules to maintain HIPAA and GDPR compliance.
Compared to similar skills
openevidence-data-handling side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| openevidence-data-handling (this skill) | 1 | 2mo | Review | Intermediate |
| security-header-generator | 5 | 11mo | Caution | Intermediate |
| backend-security-coder | 24 | 5mo | No flags | Intermediate |
| api-security-best-practices | 15 | 8mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by jeremylongshore
View all by jeremylongshore →You might also like
security-header-generator
Dexploarer
Generates security HTTP headers (CSP, HSTS, CORS, etc.) for web applications to prevent common attacks. Use when user asks to "add security headers", "setup CSP", "configure CORS", "secure headers", or "HSTS setup".
backend-security-coder
sickn33
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
api-security-best-practices
davila7
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
windows-kernel-security
gmh5225
Guide for Windows kernel security research including driver development, system callbacks, security features, and kernel exploitation. Use this skill when working with Windows drivers, PatchGuard, DSE, or kernel-level security mechanisms.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.