# PHI Gate

> Paste the clinical software module that touches patient data and get four reviews over it. The
> measurement — an inventory of the eighteen HIPAA Safe Harbor identifiers, every sink each one
> reaches, the Security Rule safeguard signals, the clinical-safety checks present and absent, and a
> comparison of your written policy against what the code actually does — runs entirely in the
> browser and is free. The four model lanes are metered.

- URL: https://phi-gate.skillsafe.ai/
- API tutorial: https://phi-gate.skillsafe.ai/api.html
- API base: https://api.skillsafe.ai/v1/app-api
- Model: `gpt-terra` (currently resolves to `gpt-5.6-terra`), publisher markup 1000 bps
- What it is NOT: a legal opinion, a HIPAA certification (no such thing exists), or a substitute for
  the risk analysis required by 45 CFR 164.308(a)(1).

## What it does

One work object: a paste of the source files, schema and configuration that handle patient data.
Four lanes over that same paste, selected by a `task` field in the run input.

| `task` | Lane | Question it answers |
| --- | --- | --- |
| `phi` | Patient-data exposure audit | Which Safe Harbor identifiers does this module hold, where does each one go, and does the redactor we already have stop it? |
| `hipaa` | HIPAA Security Rule gate | Which safeguards are present, absent, asserted-only or contradicted by the code, and does this ship? |
| `emr` | EMR workflow clinical-safety review | What can a clinician do here that they should not be able to, and in what order do we fix it? |
| `cdss` | Decision-support alert review | Would a clinician trust these alerts, and what does a missing observation do to the score? |

The intended pipeline is `phi` → `hipaa` → `emr` → `cdss`; each lane's result panel offers the next
one as a button on the same measurement.

## The free, in-browser half

No account, no network, no run. Runs on every keystroke against the paste:

- **Identifier inventory.** Field names classified against the eighteen Safe Harbor identifier
  categories of 45 CFR 164.514(b)(2), each marked `direct` (identifies a person alone), `quasi`
  (re-identifies in combination) or `clinical` (the payload the identifiers unlock). Counted by
  *category*, because Safe Harbor requires all eighteen to be absent.
- **Leak-vector tracing.** Every place an identifier reaches a log, a URL or query string, an
  analytics/monitoring vendor, an exception message, a file or export, an outbound message, or a
  cache or queue key. A payload assembled into a local variable one statement earlier is traced one
  hop, because that — not a literal at the call site — is how patient data actually reaches a vendor.
- **On-host or off-host, per vector.** Every leak carries `crosses_boundary`. An identifier written
  to a local log and the same identifier POSTed to an analytics vendor are both leaks, but only the
  second is a disclosure that needs a business associate agreement under 45 CFR 164.308(b)(1). The
  detectors for the two families live in separate modules (`phiscan.js` and `signals-egress.js`).
- **Mitigation-aware severity.** `inline` (a redaction or hashing call wraps the value here) grades
  at most `low`; `file` (the module registers a redactor that does not cover this call site) grades
  at most `high`; `none` with a direct identifier grades `critical`. Calls that write a genuine audit
  record are excluded entirely — an audit trail without identifiers is not an audit trail.
- **Security Rule safeguard table.** Access control, unique user identification, emergency access,
  automatic logoff, encryption at rest, audit controls, integrity, authentication, transmission
  security, minimum necessary, de-identification, business associate agreements, breach
  notification, workforce training and documentation retention. Each looked for twice — in the code
  and in the pasted policy prose — and marked `present`, `partial`, `absent`, `asserted-only` or
  `contradicted`.
- **Policy-prose reading.** Negation is tracked against each topic's polarity, so "PHI is never
  written to logs" reads as an assurance about a hazard while "there is no audit trail" reads as a
  missing control. A retention period written as "about seven years" parses as a policy, not an
  absence. A business-associate sentence naming several vendors keeps each vendor's own qualifier
  attached to that vendor, so one pending BAA in a list of three is reported as uncovered.
- **Clinical-safety signals.** Allergy, drug-interaction and dose-range checks; units discipline;
  duplicate orders; renal/hepatic and paediatric adjustment; override capture; alert tiering and
  suppression; encounter lifecycle; attestation; amendment history; named clinical scores
  (NEWS2, qSOFA, MEWS, CHA2DS2-VASc and others) and whether a missing observation is handled.
- **Exports.** Identifier CSV, flag CSV, safeguard CSV, the whole measurement as JSON, and a
  generated PHI redaction denylist grouped by identifier category.

## Run input

The run body **is the input object itself** — it is never wrapped in an `input` key.

```json
{
  "task": "phi",
  "project_label": "meridian-ehr / medications service",
  "policy_notes": "All PHI is encrypted at rest… PHI is never written to application logs…",
  "notes": "Ships to one pilot hospital in four weeks.",
  "facts": { }
}
```

`facts` is the browser measurement and is required — the module source is **never** sent. It carries
`flags_total` (derived from the `flags` array itself, never counted separately), `must_reconcile`
(the critical and high flag ids), `totals`, `files`, `identifier_summary`, `identifier_sample`,
`leak_sample`, `safeguards`, `clinical_signals`, `clinical_scores`, `business_associates`,
`retention_policy`, `flags`, `code_excerpts` and `sampling`. Each `leak_sample` row carries
`mitigation`, `reached_via` and `crosses_boundary`.

`identifier_sample` and `leak_sample` are **samples**. `sampling` states the population, how many
rows were sent, and how many files and categories the draw covered. The draw is a golden-ratio
low-discrepancy sequence rather than an every-k-th stride, because source files are periodic and a
stride resonates with them — it can report a broad sample while having landed on one file.

## Output contract

One JSON object. Shared envelope for all four lanes: `lane`, `lane_inferred`, `title`, `posture`
(`compliant` / `watch` / `at-risk` / `critical`), `verdict`, `summary`, `headline_numbers`,
`findings[]`, `coverage_check[]`, `artifact`, `next_lane`, `assumptions`, `open_questions`, `body`.
Only `body` differs per lane. Every critical and high flag in the measurement gets exactly one
`coverage_check` row; anything the reply neither raises nor explains away is shown on the page as
unreviewed rather than treated as clean, and a `coverage_check` row naming a flag id the measurement
never produced is reported as unsupported.

## Attribution

A derived work built on four published agent skills, credited in full:

- https://skillsafe.ai/skill/@affaan-m/healthcare-phi-compliance/
- https://skillsafe.ai/skill/@affaan-m/hipaa-compliance/
- https://skillsafe.ai/skill/@affaan-m/healthcare-emr-patterns/
- https://skillsafe.ai/skill/@affaan-m/healthcare-cdss-patterns/

Not affiliated with, endorsed by or maintained by those skills' author, nor by the U.S. Department of
Health and Human Services.

## Privacy

Paste code, schema and configuration — never a patient record. A field named `ssn` is what the
scanner reads; an actual number tells it nothing more. The paste stays in the page; a run sends only
the measurement, and the page prints what was sent before it goes. Run history is stored in the
app's `reviews` collection against the signed-in user's account, with `localStorage` as a
device-local mirror only.