phi-log-scan

name	phi-log-scan
description	Find logger / print / structlog calls in backend/app/ that reference PHI field names. Use when the user says "run /phi-log-scan", worries a new log line might leak PHI, or is reviewing a CI failure about PHI in stdout. Intentional AuditService calls are excluded.
tools	["Read","Bash","Glob"]

PHI Log Scan

Enforces CLAUDE.md guardrail #5: "PHI never enters stdout."

Walks every .py file under backend/app/ and, for each call expression, checks whether its printable arguments (f-strings, format strings, .format(...), %-style) reference PHI field names. Calls on AuditService (or any audit.*) are intentional and skipped — those are the sanctioned PHI path.

How to run

python .claude/skills/phi-log-scan/check.py

PHI field names

patient_name, first_name, last_name, email, phone, dob, diagnosis, ssn, mrn, transcript, note_body, address.

What counts as a "log call"

Any call whose invocation name matches:

• logger.<level>, log.<level>, logging.<level>
• structlog.*
• bare print(...)

<level> is any of: debug, info, warning, warn, error, critical, exception.

What is intentionally skipped

• Calls on anything named audit (audit.log_event(...), self._audit.log_*(...))
• Calls inside backend/tests/ and backend/app/services/audit_service.py (the audit machinery itself)

Output

For each finding: file:line call suggested fix — typical fix is to drop the PHI token and reference the resource by ID instead, e.g.:

logger.info("patient_name=%s", patient.name)
# →
logger.info("patient_id=%s", patient.id)

Exit code 1 if any findings, 0 otherwise.