checking-hipaa-compliance

# Checking HIPAA compliance before deploying on PHI Before any pipeline touches **protected health information (PHI)**, the operating entity (a covered entity or its business associate) must have the HIPAA **Privacy Rule** and **Security Rule** safeguards in place. This skill walks a concrete pipeline against those requirements and emits a **gap report**: which controls are met, which are missing, and where OpenMed's on-device de-identification and signed audit trail satisfy a requirement. The full control list — administrative, physical, and technical safeguards with their 45 CFR citations — is in [references/hipaa-checklist.md](references/hipaa-checklist.md). This skill is a **self-assessment aid**, not legal advice; a Privacy Officer signs off on compliance. ## When to use - You are about to deploy OpenMed (or any pipeline) on real PHI and need a go/no-go compliance review. - You must document **safeguards** and **minimum-necessary** controls for an audit, a BAA, or a security questionnaire. - You want to decide between **Safe Harbor** and **Expert Determination** de-identification and record the rationale. - You need a reproducible gap report you can hand to a Privacy/Security Officer. ## The two paths to "no longer PHI" HIPAA recognizes two de-identification methods (45 CFR 164.514): 1. **Safe Harbor** — remove all **18 identifier categories** and have no actual knowledge the result can re-identify. Deterministic, the common path. 2. **Expert Determination** — a qualified statistician certifies "very small" re-identification risk. Used when you must keep some quasi-identifiers. OpenMed's `deidentify(..., policy="hipaa_safe_harbor")` targets the Safe Harbor identifier set on-device, and `deidentify(..., audit=True)` produces a signed, PHI-free `AuditReport` that documents *what* was removed — the evidence a Safe Harbor attestation and a Security Rule audit control both want. ## Quick start ```python import openmed # A representative record from the pipeline (synthetic — never log real PHI). sample = "John Doe (MRN 1234567), DOB 1970-01-15, seen 2024-03-02 in Boston." # 1) De-identify on-device under the Safe Harbor policy. result = openmed.deidentify(sample, method="replace", policy="hipaa_safe_harbor") print(result.deidentified_text) # identifiers removed/surrogated # 2) Produce the signed, no-PHI audit record for the compliance file. report = openmed.deidentify(sample, policy="hipaa_safe_harbor", audit=True) report.sign(b"<release-hmac-key-from-vault>", key_id="hipaa-2026") # 3) Walk the checklist (see references/hipaa-checklist.md) and record gaps. controls = { "encryption_at_rest": True, "encryption_in_transit": True, "access_controls_rbac": True, "audit_logging": True, # satisfied in part by the signed AuditReport "minimum_necessary": False, # <-- gap: pipeline pulls full notes "baa_in_place": True, "deidentification_method": "safe_harbor", } gaps = [name for name, ok in controls.items() if not ok] print("GAPS:", gaps) ``` ## Workflow 1. **Map the data flow.** Diagram every place PHI is created, received, maintained, or transmitted — including model caches, temp files, and logs. 2. **Confirm the legal basis.** Is the operator a covered entity or business associate? Is a **BAA** in place with every downstream vendor that touches PHI? OpenMed running on-device means *no* third-party processor for the NLP step — note that as a control in your favor. 3. **Run the three safeguard groups** from [references/hipaa-checklist.md](references/hipaa-checklist.md): administrative (risk analysis, workforce training, sanctions), physical (facility/device controls), and technical (access control, audit controls, integrity, transmission security). 4. **Enforce minimum necessary.** Pull only the fields the task needs; mask the rest. De-identify as early in the flow as the use case allows. 5. **Record the de-identification method** (Safe Harbor vs Expert Determination) and attach the signed `AuditReport` as evidence. 6. **Emit the gap report** — met / not-met / N/A per control, with the 45 CFR citation and the remediation owner. Hand it to the Privacy Officer. ## Hand-off to / from OpenMed - **De-identification:** `deidentifying-clinical-text` (`openmed.deidentify`, `policy="hipaa_safe_harbor"`) is the technical control that converts PHI to non-PHI on-device — the heart of a HIPAA pipeline. - **Identifier coverage:** `auditing-safe-harbor-checklist` maps detected spans to the 18 Safe Harbor categories so you can prove each is handled. - **Audit control:** `auditing-deidentification-runs` (`audit=True` → `AuditReport.sign()/.verify()`) gives the tamper-evident, PHI-free record the Security Rule audit-controls standard (164.312(b)) expects. - **No-PHI logging:** `enforcing-nophi-logging` keeps identifiers out of logs and traces (a recurring audit finding). - OpenMed is **local-first** — the NLP step adds no new business associate. ## Edge cases & gotchas - **De-identified data is out of scope — but only if done right.** Safe Harbor requires *all 18* categories removed *and* no actual knowledge of re-identifiability. A residual rare ZIP3 or a free-text name the model missed re-introduces PHI. Verify coverage; don't assume. - **Limited Data Sets are still PHI.** Dates and ZIPs retained under a Data Use Agreement (164.514(e)) are not de-identified — different rules apply. - **Logs and caches are PHI too.** Model caches, exception messages, and temp files holding raw notes are in scope. This is the most common gap. - **A BAA is required for every vendor** that creates/receives/maintains/ transmits PHI on your behalf — including cloud storage and any LLM API. Running OpenMed on-device avoids adding one for the NLP step. - **Minimum necessary is a duty, not a nicety** (164.502(b)). Don't pull full charts when a problem list suffices. - **Breach notification clock.** Unsecured PHI exposure triggers 164.400-414 duties; encryption to NIST standards renders data "secured" and can avoid the notification trigger. - **Not legal advice.** This checklist supports, but does not replace, a Privacy Officer's determination and (for Expert Determination) a qualified statistician. ## Standards & references - HHS HIPAA for Professionals (hub): https://www.hhs.gov/hipaa/for-professionals/index.html - Privacy Rule, 45 CFR Part 164 Subpart E: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E - Security Rule, 45 CFR Part 164 Subpart C: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C - De-identification guidance (Safe Harbor & Expert Determination), 164.514: https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html - HHS Security Risk Assessment Tool: https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool - NIST SP 800-66r2 (implementing the Security Rule): https://csrc.nist.gov/pubs/sp/800/66/r2/final