[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFSYY6T30WDZ2S47ZWWEFS":3,"skill-same:01M6AFSYY6T30WDZ2S47ZWWEFS":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":41,"commitSha":42,"skillDirectory":43,"forksCount":44,"repositoryHtmlUrl":45,"repositoryHomepageUrl":6,"ownerHtmlUrl":46,"ownerBlogUrl":47,"ownerDescription":48,"updatedAt":49,"install":50,"resources":63},"01M6AFSYY6T30WDZ2S47ZWWEFS","hipaa-employee-training",null,"Implements HIPAA workforce training requirements under 45 CFR §164.530(b) (Privacy Rule) and 45 CFR §164.308(a)(5) (Security Rule). Covers initial onboarding training, periodic refresher cadence, role-based content differentiation, documentation of training completion, and sanction policy integration. Keywords: HIPAA training, workforce training, security awareness, privacy training, §164.530(b), §164.308(a)(5).","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fhipaa-employee-training\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31],"training","hipaa","hipaa employee training","security","policy","documentation","onboarding","content","integration","compliance","privacy","awareness","security-awareness","2026-11-10 10:12:30",false,"---\nname: hipaa-employee-training\ndescription: >-\n  Implements HIPAA workforce training requirements under 45 CFR §164.530(b)\n  (Privacy Rule) and 45 CFR §164.308(a)(5) (Security Rule). Covers initial\n  onboarding training, periodic refresher cadence, role-based content\n  differentiation, documentation of training completion, and sanction\n  policy integration. Keywords: HIPAA training, workforce training,\n  security awareness, privacy training, §164.530(b), §164.308(a)(5).\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: healthcare-privacy\n  tags: \"hipaa, employee-training, workforce-training, security-awareness, privacy-training, compliance-training\"\n---\n\n# HIPAA Employee Training — 45 CFR §164.530(b) and §164.308(a)(5)\n\n## Overview\n\nThe HIPAA Privacy Rule at 45 CFR §164.530(b)(1) requires covered entities to train all members of the workforce on the policies and procedures with respect to PHI as necessary and appropriate for the members of the workforce to carry out their functions. The Security Rule at 45 CFR §164.308(a)(5)(i) requires implementation of a security awareness and training program for all members of the workforce including management. Workforce includes employees, volunteers, trainees, and persons whose conduct is under the direct control of the entity whether or not paid by the entity (45 CFR §160.103).\n\n## Regulatory Framework\n\n### Privacy Rule Training — §164.530(b)\n\n- **§164.530(b)(1)**: A covered entity must train all members of its workforce on policies and procedures with respect to PHI as necessary and appropriate for the workforce members to carry out their functions within the covered entity\n- **§164.530(b)(2)(i)**: Training must be provided to each new member of the workforce within a reasonable period of time after joining\n- **§164.530(b)(2)(ii)**: Training must be provided to each member of the workforce whose functions are affected by a material change in policies or procedures within a reasonable period of time after the change\n\n### Security Rule Training — §164.308(a)(5)\n\n- **§164.308(a)(5)(i)**: Implement a security awareness and training program for all members of the workforce (including management) — this is a required standard\n- **§164.308(a)(5)(ii)(A)**: Security reminders (addressable)\n- **§164.308(a)(5)(ii)(B)**: Protection from malicious software (addressable)\n- **§164.308(a)(5)(ii)(C)**: Log-in monitoring (addressable)\n- **§164.308(a)(5)(ii)(D)**: Password management (addressable)\n\n### Sanction Policy — §164.530(e) and §164.308(a)(1)(ii)(C)\n\nTraining is directly linked to the sanction policy: workforce members who violate HIPAA policies may be subject to sanctions, but only if they have been trained on the applicable requirements.\n\n## Training Program Structure\n\n### Tier 1: General Workforce Training (All Staff)\n\nAll workforce members regardless of role must receive training on:\n\n| Topic | Content | Regulatory Basis |\n|-------|---------|-----------------|\n| What is PHI | 18 HIPAA identifiers, definition under §160.103 | §164.530(b)(1) |\n| Permitted uses and disclosures | TPO, required by law, public health, judicial orders | §164.502 |\n| Minimum necessary standard | Limit PHI to what is needed for the purpose | §164.502(b) |\n| Patient rights | Access, amendment, accounting, restriction, confidential communications | §164.520-528 |\n| Breach reporting | Internal reporting procedures, how to identify a breach | §164.530(b) + Breach Notification Rule |\n| Security basics | Password policy, workstation security, mobile device rules | §164.308(a)(5) |\n| Social engineering | Phishing recognition, pretexting, tailgating prevention | §164.308(a)(5)(ii)(B) |\n| Sanctions | Consequences for HIPAA violations per organization policy | §164.530(e)(1) |\n\n### Tier 2: Role-Based Training\n\n| Workforce Role | Additional Training Topics |\n|---------------|--------------------------|\n| Clinical staff | EHR access protocols, verbal disclosures in clinical settings, patient identity verification, break-the-glass procedures |\n| HIM \u002F Medical Records | Release of information procedures, authorization validation, minimum necessary for disclosures, accounting of disclosures |\n| IT \u002F Technical staff | ePHI encryption requirements, access control administration, audit log management, incident response, business continuity |\n| Management \u002F Supervisors | Sanction policy administration, workforce access reviews, risk assessment participation, breach escalation |\n| Front desk \u002F Registration | Notice of Privacy Practices distribution, directory opt-out process, patient identity verification, fax\u002Fphone PHI protocols |\n| Research staff | IRB\u002FPrivacy Board requirements, authorization vs waiver, de-identification, limited data set use |\n| Business office \u002F Billing | PHI in billing workflows, payer communications, collections and PHI, business associate interactions |\n\n### Tier 3: Specialized Training\n\nFor personnel with specific compliance responsibilities:\n\n- **Privacy Officer**: Annual regulatory update, enforcement trends, OCR audit methodology\n- **Security Officer**: NIST Cybersecurity Framework updates, threat landscape, vulnerability management\n- **Incident response team**: Breach determination, risk assessment methodology, notification procedures, forensic preservation\n- **BAA managers**: Business associate monitoring, subcontractor requirements, termination procedures\n\n## Training Cadence\n\n| Event | Training Requirement | Timeline |\n|-------|---------------------|----------|\n| New hire | General + role-based training | Within 30 days of hire (before PHI access) |\n| Role change | Role-based training for new role | Within 30 days of role change |\n| Policy change | Material change training | Within reasonable period after change |\n| Annual refresher | General awareness + emerging threats | Annually |\n| Incident-triggered | Targeted retraining on violation area | Within 30 days of incident |\n| Regulatory update | Updated requirements training | Within 60 days of effective date |\n\n## Documentation Requirements — §164.530(j)\n\nTraining documentation must be retained for 6 years from creation date or last effective date and must include:\n\n1. Training materials and content used\n2. Date of each training session\n3. Attendance records (name, role, date, method of delivery)\n4. Assessment scores or acknowledgment of completion\n5. Evidence of policy receipt and acknowledgment\n6. Corrective training records following incidents\n\n## Enforcement Examples\n\n- **Hospice of North Idaho (2013)**: $50,000 settlement — OCR found no evidence of HIPAA Security Rule training for workforce members prior to the breach of an unencrypted laptop\n- **Columbia University\u002FNew York Presbyterian (2014)**: $4.8 million combined — inadequate training contributed to physician deactivating a personal server containing ePHI of 6,800 patients\n- **Anthem Inc. (2018)**: $16 million — largest HIPAA settlement; OCR noted failure to conduct adequate security awareness and training as a contributing factor\n\n## Integration Points\n\n- **hipaa-privacy-rule**: Training content must align with the organization's Privacy Rule policies\n- **hipaa-security-rule**: Security awareness training is a required Security Rule standard\n- **hipaa-breach-notification**: Training must cover breach identification and internal reporting\n- **hipaa-risk-analysis**: Risk analysis findings should inform training priorities\n- **hipaa-minimum-necessary**: Minimum necessary standard must be included in general training\n","# HIPAA Employee Training — 45 CFR §164.530(b) and §164.308(a)(5)\n\n## Overview\n\nThe HIPAA Privacy Rule at 45 CFR §164.530(b)(1) requires covered entities to train all members of the workforce on the policies and procedures with respect to PHI as necessary and appropriate for the members of the workforce to carry out their functions. The Security Rule at 45 CFR §164.308(a)(5)(i) requires implementation of a security awareness and training program for all members of the workforce including management. Workforce includes employees, volunteers, trainees, and persons whose conduct is under the direct control of the entity whether or not paid by the entity (45 CFR §160.103).\n\n## Regulatory Framework\n\n### Privacy Rule Training — §164.530(b)\n\n- **§164.530(b)(1)**: A covered entity must train all members of its workforce on policies and procedures with respect to PHI as necessary and appropriate for the workforce members to carry out their functions within the covered entity\n- **§164.530(b)(2)(i)**: Training must be provided to each new member of the workforce within a reasonable period of time after joining\n- **§164.530(b)(2)(ii)**: Training must be provided to each member of the workforce whose functions are affected by a material change in policies or procedures within a reasonable period of time after the change\n\n### Security Rule Training — §164.308(a)(5)\n\n- **§164.308(a)(5)(i)**: Implement a security awareness and training program for all members of the workforce (including management) — this is a required standard\n- **§164.308(a)(5)(ii)(A)**: Security reminders (addressable)\n- **§164.308(a)(5)(ii)(B)**: Protection from malicious software (addressable)\n- **§164.308(a)(5)(ii)(C)**: Log-in monitoring (addressable)\n- **§164.308(a)(5)(ii)(D)**: Password management (addressable)\n\n### Sanction Policy — §164.530(e) and §164.308(a)(1)(ii)(C)\n\nTraining is directly linked to the sanction policy: workforce members who violate HIPAA policies may be subject to sanctions, but only if they have been trained on the applicable requirements.\n\n## Training Program Structure\n\n### Tier 1: General Workforce Training (All Staff)\n\nAll workforce members regardless of role must receive training on:\n\n| Topic | Content | Regulatory Basis |\n|-------|---------|-----------------|\n| What is PHI | 18 HIPAA identifiers, definition under §160.103 | §164.530(b)(1) |\n| Permitted uses and disclosures | TPO, required by law, public health, judicial orders | §164.502 |\n| Minimum necessary standard | Limit PHI to what is needed for the purpose | §164.502(b) |\n| Patient rights | Access, amendment, accounting, restriction, confidential communications | §164.520-528 |\n| Breach reporting | Internal reporting procedures, how to identify a breach | §164.530(b) + Breach Notification Rule |\n| Security basics | Password policy, workstation security, mobile device rules | §164.308(a)(5) |\n| Social engineering | Phishing recognition, pretexting, tailgating prevention | §164.308(a)(5)(ii)(B) |\n| Sanctions | Consequences for HIPAA violations per organization policy | §164.530(e)(1) |\n\n### Tier 2: Role-Based Training\n\n| Workforce Role | Additional Training Topics |\n|---------------|--------------------------|\n| Clinical staff | EHR access protocols, verbal disclosures in clinical settings, patient identity verification, break-the-glass procedures |\n| HIM \u002F Medical Records | Release of information procedures, authorization validation, minimum necessary for disclosures, accounting of disclosures |\n| IT \u002F Technical staff | ePHI encryption requirements, access control administration, audit log management, incident response, business continuity |\n| Management \u002F Supervisors | Sanction policy administration, workforce access reviews, risk assessment participation, breach escalation |\n| Front desk \u002F Registration | Notice of Privacy Practices distribution, directory opt-out process, patient identity verification, fax\u002Fphone PHI protocols |\n| Research staff | IRB\u002FPrivacy Board requirements, authorization vs waiver, de-identification, limited data set use |\n| Business office \u002F Billing | PHI in billing workflows, payer communications, collections and PHI, business associate interactions |\n\n### Tier 3: Specialized Training\n\nFor personnel with specific compliance responsibilities:\n\n- **Privacy Officer**: Annual regulatory update, enforcement trends, OCR audit methodology\n- **Security Officer**: NIST Cybersecurity Framework updates, threat landscape, vulnerability management\n- **Incident response team**: Breach determination, risk assessment methodology, notification procedures, forensic preservation\n- **BAA managers**: Business associate monitoring, subcontractor requirements, termination procedures\n\n## Training Cadence\n\n| Event | Training Requirement | Timeline |\n|-------|---------------------|----------|\n| New hire | General + role-based training | Within 30 days of hire (before PHI access) |\n| Role change | Role-based training for new role | Within 30 days of role change |\n| Policy change | Material change training | Within reasonable period after change |\n| Annual refresher | General awareness + emerging threats | Annually |\n| Incident-triggered | Targeted retraining on violation area | Within 30 days of incident |\n| Regulatory update | Updated requirements training | Within 60 days of effective date |\n\n## Documentation Requirements — §164.530(j)\n\nTraining documentation must be retained for 6 years from creation date or last effective date and must include:\n\n1. Training materials and content used\n2. Date of each training session\n3. Attendance records (name, role, date, method of delivery)\n4. Assessment scores or acknowledgment of completion\n5. Evidence of policy receipt and acknowledgment\n6. Corrective training records following incidents\n\n## Enforcement Examples\n\n- **Hospice of North Idaho (2013)**: $50,000 settlement — OCR found no evidence of HIPAA Security Rule training for workforce members prior to the breach of an unencrypted laptop\n- **Columbia University\u002FNew York Presbyterian (2014)**: $4.8 million combined — inadequate training contributed to physician deactivating a personal server containing ePHI of 6,800 patients\n- **Anthem Inc. (2018)**: $16 million — largest HIPAA settlement; OCR noted failure to conduct adequate security awareness and training as a contributing factor\n\n## Integration Points\n\n- **hipaa-privacy-rule**: Training content must align with the organization's Privacy Rule policies\n- **hipaa-security-rule**: Security awareness training is a required Security Rule standard\n- **hipaa-breach-notification**: Training must cover breach identification and internal reporting\n- **hipaa-risk-analysis**: Risk analysis findings should inform training priorities\n- **hipaa-minimum-necessary**: Minimum necessary standard must be included in general training\n",{"name":5,"license":15,"metadata":37,"description":7},{"tags":38,"author":9,"domain":29,"version":39,"subdomain":40},"hipaa, employee-training, workforce-training, security-awareness, privacy-training, compliance-training","1.0","healthcare-privacy","main","9b2ef9eae161c00a17241d42a388571321b33e9f","skills\u002Fprivacy\u002Fhipaa-employee-training",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill hipaa-employee-training",{"tool":56,"command":57},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill hipaa-employee-training",{"tool":59,"command":60},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill hipaa-employee-training","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fhipaa-employee-training\u002FSKILL.md",true,[64,70,76,80],{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"assets\u002Ftemplate.md","ASSET","资产文件",5036,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fhipaa-employee-training\u002Fassets\u002Ftemplate.md",{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Fstandards.md","REFERENCE","参考文档",3783,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fhipaa-employee-training\u002Freferences\u002Fstandards.md",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fworkflows.md",6863,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fhipaa-employee-training\u002Freferences\u002Fworkflows.md",{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fprocess.py","SCRIPT","脚本",9403,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fhipaa-employee-training\u002Fscripts\u002Fprocess.py",[87,113,130,143,160,172],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":106,"publishedAt":32},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[93,98,101],{"categoryNo":94,"categoryName":95,"taxonomyType":96,"taxonomyTypeDesc":97},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":99,"categoryName":100,"taxonomyType":96,"taxonomyTypeDesc":97},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[107,108,29,28,26,109,23,110,111,112],"email","workplace email privacy","data","testing","monitoring","metadata",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":123,"publishedAt":32},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[119,122],{"categoryNo":120,"categoryName":121,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[109,124,125,126,28,127,128,29,129],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":32},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[136],{"categoryNo":120,"categoryName":121,"taxonomyType":104,"taxonomyTypeDesc":105},[109,138,139,140,141,128,29,142],"vendor termination data","planning","verification","extraction","certification",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":32},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[149],{"categoryNo":120,"categoryName":121,"taxonomyType":104,"taxonomyTypeDesc":105},[151,152,153,154,155,156,157,158,29,109,159],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":167,"publishedAt":32},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[166],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[29,168,128,169,156,25,170,109,159,152,142,171],"vendor privacy due diligence","review","flow","analysis",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":185,"publishedAt":32},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[178,181,184],{"categoryNo":179,"categoryName":180,"taxonomyType":96,"taxonomyTypeDesc":97},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":182,"categoryName":183,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[186,187,29,188,140,189,28,128,190,159,191,192,193,139],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]