Hipaa Compliance Checker

Clinical Use Cases

• Research data preparation: A clinical researcher needs to share patient records with an external collaborator. The skill de-identifies an entire cohort's clinical notes, replacing all PHI with synthetic equivalents while preserving clinical content, temporal relationships, and data structure needed for the study
• Training dataset creation: A health system building an internal NLP model needs de-identified clinical text for model training. The obfuscated output mode produces realistic-looking notes that preserve linguistic patterns without exposing real patient information
• Incident response: After an accidental data exposure, the compliance team runs the affected documents through the skill to catalog exactly which PHI elements were present and generate a breach risk assessment
• Cross-institutional data sharing: Two hospitals participating in a quality improvement collaborative use the skill to de-identify outcomes data before sharing, satisfying both HIPAA Safe Harbor requirements and their respective IRB protocols

Safety & Evidence

• Safety Classification: Safe — The skill removes or replaces PHI; it does not transmit, store, or expose patient data. Processing occurs entirely within the local environment. The skill is a privacy-enhancing tool that reduces PHI exposure risk.
• Evidence Level: High — De-identification methodology follows HIPAA Safe Harbor standards (45 CFR 164.514(b)(2)) with all 18 identifier categories covered. Clinical NLP entity detection is validated against i2b2/n2c2 de-identification benchmarks. The underlying engine has been tested across millions of clinical documents.

Example Usage

Masked output mode:

De-identify the following clinical note (masked mode):

"John Smith, DOB 03/15/1958, MRN 4472891, was seen in clinic today at
Massachusetts General Hospital. He reports his chest pain has improved
since his visit on 02/28/2026. Contact: (617) 555-0142."

De-identified output: "[PATIENT], DOB [DATE], MRN [MRN], was seen in clinic today at [FACILITY]. He reports his chest pain has improved since his visit on [DATE]. Contact: [PHONE]."

PHI Detection Report:

Entity	Type	Original	Confidence
John Smith	PATIENT_NAME	John Smith	0.99
03/15/1958	DATE_OF_BIRTH	03/15/1958	0.98
4472891	MEDICAL_RECORD_NUMBER	4472891	0.97
Massachusetts General Hospital	FACILITY	MGH	0.96
02/28/2026	DATE	02/28/2026	0.99
(617) 555-0142	PHONE_NUMBER	(617) 555-0142	0.99

Obfuscated output mode:

De-identify the same note (obfuscated mode)

Obfuscated output: "Maria Chen, DOB 07/22/1961, MRN 7813254, was seen in clinic today at Riverside Community Medical Center. She reports her chest pain has improved since her visit on 01/15/2026. Contact: (312) 555-0897."

Technical Details

• Category: Administrative
• Author: OMS Contributors
• License: Commercial
• Version: 6.3.0
• Specialty: Health Information Management, Compliance
• Review Status: Verified by OMS Review Team

References

• HIPAA Privacy Rule, 45 CFR 164.514(b) — Safe Harbor De-identification Standard
• HHS Guidance Regarding Methods for De-identification of Protected Health Information (2012, updated 2022)
• Stubbs A, Uzuner O, et al. "Automated systems for the de-identification of longitudinal clinical narratives: Overview of 2014 i2b2/UTHealth shared task Track 1." J Biomed Inform. 2015;58:S11-S19.
• Dernoncourt F, et al. "De-identification of patient notes with recurrent neural networks." J Am Med Inform Assoc. 2017;24(3):596-606.
• OCR HIPAA Breach Notification Rule, 45 CFR 164.400-414

This skill is part of Open Medical Skills, a curated marketplace of medical AI skills maintained by physicians for physicians and the healthcare industry.