PHI Readiness Stages

Assess the current PHI Readiness Stage (PRS) of a workload, repository, system, or environment; determine HIPAA applicability and role; identify evidence gap...

Security Scan

The skill is an instruction-only HIPAA/PHI readiness assessment framework whose requested files, instructions, and lack of installs/credentials are coherent with its stated purpose.

Purpose & Capability

Name and description match the files and runtime instructions. The repository is an evidence-driven PRS assessment framework and does not request unrelated binaries, credentials, or installs.

Instruction Scope

SKILL.md and AGENTS.md instruct agents to load internal framework files, verify official HHS/NIST sources live, and follow strict evidence-handling rules. This is appropriate for assessment work, but reviewers should be aware the workflow expects verification of live external sources and handling of potentially sensitive evidence (the repo includes an evidence-handling guide). Ensure the agent is not permitted to request, store, or transmit raw PHI outside approved channels.

Install Mechanism

Instruction-only skill with no install spec and no code files to execute; nothing is downloaded or written to disk by the skill bundle itself.

Credentials

The skill requires no environment variables, credentials, or config paths. There are no disproportionate secret/credential requests relative to the assessment purpose.

Persistence & Privilege

No 'always: true' privilege and normal autonomous invocation is allowed. The skill does not request system-wide configuration changes or cross-skill modifications.

Assessment

This repo is a documentation-driven PHI-readiness assessment framework and appears internally consistent. Before installing or using it: (1) confirm agent network access and browsing policies for verifying live HHS/NIST sources; (2) do not upload or allow the agent to exfiltrate raw PHI — follow your organization's evidence-handling rules (the repo includes guidance on this); (3) verify that autonomous agent actions are limited to permitted operations (e.g., read repo files, fetch public official links) and cannot transmit sensitive artifacts to unapproved endpoints; and (4) if you expect the skill to handle real evidence, review the framework's 'assessment-evidence-handling' file and enforce strict access/audit controls. Overall, nothing in the bundle appears disproportionate or malicious.

This top-level SKILL.md is the canonical install and publish entrypoint for the repository root.

It is suitable for Codex, Claude Code, and OpenClaw-compatible registries that publish a root skill folder directly.

The detailed PRS assessment workflow lives in skills/phi-readiness-review/SKILL.md.

If you are using this as an installed or published skill, always load files in this order:

1. skills/phi-readiness-review/SKILL.md
2. framework/assessment-rules.md
3. framework/assessment-evidence-handling.md
4. framework/applicability-role-matrix.md
5. framework/stage-rubric.md
6. framework/evidence-levels.md
7. framework/evidence-freshness.md
8. framework/minimum-artifact-matrix.md
9. framework/regulatory-boundaries.md
10. framework/output-contract.md

Then load only the additional control, checklist, and reference files needed for the specific assessment.

When a review needs rule-level traceability or a baseline-versus-policy distinction, also load mappings/hipaa-security-rule-crosswalk.md.

If you are using the repository itself as context rather than as an installed skill, start from AGENTS.md.