[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6H87MC0SHGZ8FS3CFVKPJXE":3,"skill-same:01M6H87MC0SHGZ8FS3CFVKPJXE":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6H87MC0SHGZ8FS3CFVKPJXE","openevidence-security-basics",null,"Apply OpenEvidence security best practices for HIPAA compliance and PHI protection.\nUse when securing API keys, implementing PHI handling,\nor auditing OpenEvidence security configuration.\nTrigger with phrases like \"openevidence security\", \"openevidence hipaa\",\n\"openevidence phi\", \"secure openevidence\", \"openevidence compliance\".","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Fopenevidence-pack\u002Fskills\u002Fopenevidence-security-basics\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"security","openevidence security basics","basics","write","for","implementing","with","phi handling","trigger","io","use","openclaw","read","api","phi","security best practices","best practices","code","secure","codex","2026-11-10 10:12:30",false,"---\nname: openevidence-security-basics\ndescription: |\n  Apply OpenEvidence security best practices for HIPAA compliance and PHI protection.\n  Use when securing API keys, implementing PHI handling,\n  or auditing OpenEvidence security configuration.\n  Trigger with phrases like \"openevidence security\", \"openevidence hipaa\",\n  \"openevidence phi\", \"secure openevidence\", \"openevidence compliance\".\nallowed-tools: Read, Write, Grep\nversion: 1.0.0\nlicense: MIT\nauthor: Jeremy Longshore \u003Cjeremy@intentsolutions.io>\ncompatible-with: claude-code, codex, openclaw\n---\n# OpenEvidence Security Basics\n\n## Table of Contents\n- [Overview](#overview)\n- [Prerequisites](#prerequisites)\n- [Instructions](#instructions)\n- [Output](#output)\n- [Error Handling](#error-handling)\n- [Examples](#examples)\n- [Resources](#resources)\n\n## Overview\nSecurity best practices for OpenEvidence integrations handling Protected Health Information (PHI). Covers credential management, PHI sanitization, HIPAA audit logging, webhook verification, and data retention compliance.\n\n## Prerequisites\n- OpenEvidence SDK installed\n- Understanding of HIPAA requirements\n- Signed Business Associate Agreement (BAA)\n- Access to organization security policies\n\n## OpenEvidence Security Certifications\n- SOC 2 Type II certified\n- HIPAA compliant with BAA\n- AES-256 encryption at rest\n- TLS 1.2+ encryption in transit\n\n## Security Checklist\n- [ ] API keys in secret manager (not env vars in production)\n- [ ] BAA signed with OpenEvidence\n- [ ] PHI sanitization before all queries\n- [ ] HIPAA audit logging on all access\n- [ ] Webhook signatures verified\n- [ ] TLS 1.2+ enforced\n- [ ] Different keys for dev\u002Fstaging\u002Fprod\n- [ ] Key rotation schedule established\n- [ ] Data retention policy implemented\n\n## Instructions\n\n### Step 1: Secure Credential Management\nUse `.env` locally (gitignored), GCP Secret Manager or AWS Secrets Manager in production. Never hardcode credentials.\n\n### Step 2: Implement PHI Sanitization\nRemove names, dates, MRNs, SSNs from queries before sending to OpenEvidence. Map patient demographics to age ranges and condition categories instead of specific identifiers.\n\n### Step 3: Enable HIPAA Audit Logging\nLog all clinical queries and DeepConsult requests with userId, userRole, resourceId, ipAddress, success status. Never log actual query content or responses (may contain PHI).\n\n### Step 4: Verify Webhook Signatures\nParse `t=timestamp,v1=signature` header format. Compute HMAC-SHA256 with timing-safe comparison. Reject timestamps older than 5 minutes for replay protection.\n\n### Step 5: Configure Data Retention\n- Audit logs: 6 years (2190 days) -- HIPAA minimum\n- Query results: Do not store (re-query as needed)\n- DeepConsult reports: 1 year\n- Run daily cleanup job to enforce policies\n\n## Output\n- Secure credential management (GCP\u002FAWS Secret Manager)\n- PHI sanitization layer with pattern detection\n- HIPAA-compliant audit logging\n- Webhook signature verification with replay protection\n- Data retention compliance with automated cleanup\n\n## Error Handling\n| Security Issue | Detection | Mitigation |\n|----------------|-----------|------------|\n| Exposed API key | Git scanning alert | Rotate immediately, audit access |\n| PHI in query | Log pattern matching | Block request, alert compliance |\n| Failed signature | Webhook verification | Reject webhook, alert security |\n| Unauthorized access | Audit log review | Revoke access, investigate |\n\n## Examples\n\n### Secure Query Flow\n```typescript\nconst sanitized = sanitizeQueryForOpenEvidence(question, patientContext);\nconst response = await client.query({ question: sanitized.question, context: sanitized.context });\nawait auditLogger.logClinicalQuery(user.id, user.role, response.id, true, request);\n```\n\nSee [detailed implementation](${CLAUDE_SKILL_DIR}\u002Freferences\u002Fimplementation.md) for advanced patterns.\n\n## Resources\n- [OpenEvidence Security](https:\u002F\u002Fwww.openevidence.com\u002Fsecurity)\n- [HIPAA Security Rule](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fsecurity\u002Findex.html)\n- [NIST Cybersecurity Framework](https:\u002F\u002Fwww.nist.gov\u002Fcyberframework)","# OpenEvidence Security Basics\n\n## Table of Contents\n- [Overview](#overview)\n- [Prerequisites](#prerequisites)\n- [Instructions](#instructions)\n- [Output](#output)\n- [Error Handling](#error-handling)\n- [Examples](#examples)\n- [Resources](#resources)\n\n## Overview\nSecurity best practices for OpenEvidence integrations handling Protected Health Information (PHI). Covers credential management, PHI sanitization, HIPAA audit logging, webhook verification, and data retention compliance.\n\n## Prerequisites\n- OpenEvidence SDK installed\n- Understanding of HIPAA requirements\n- Signed Business Associate Agreement (BAA)\n- Access to organization security policies\n\n## OpenEvidence Security Certifications\n- SOC 2 Type II certified\n- HIPAA compliant with BAA\n- AES-256 encryption at rest\n- TLS 1.2+ encryption in transit\n\n## Security Checklist\n- [ ] API keys in secret manager (not env vars in production)\n- [ ] BAA signed with OpenEvidence\n- [ ] PHI sanitization before all queries\n- [ ] HIPAA audit logging on all access\n- [ ] Webhook signatures verified\n- [ ] TLS 1.2+ enforced\n- [ ] Different keys for dev\u002Fstaging\u002Fprod\n- [ ] Key rotation schedule established\n- [ ] Data retention policy implemented\n\n## Instructions\n\n### Step 1: Secure Credential Management\nUse `.env` locally (gitignored), GCP Secret Manager or AWS Secrets Manager in production. Never hardcode credentials.\n\n### Step 2: Implement PHI Sanitization\nRemove names, dates, MRNs, SSNs from queries before sending to OpenEvidence. Map patient demographics to age ranges and condition categories instead of specific identifiers.\n\n### Step 3: Enable HIPAA Audit Logging\nLog all clinical queries and DeepConsult requests with userId, userRole, resourceId, ipAddress, success status. Never log actual query content or responses (may contain PHI).\n\n### Step 4: Verify Webhook Signatures\nParse `t=timestamp,v1=signature` header format. Compute HMAC-SHA256 with timing-safe comparison. Reject timestamps older than 5 minutes for replay protection.\n\n### Step 5: Configure Data Retention\n- Audit logs: 6 years (2190 days) -- HIPAA minimum\n- Query results: Do not store (re-query as needed)\n- DeepConsult reports: 1 year\n- Run daily cleanup job to enforce policies\n\n## Output\n- Secure credential management (GCP\u002FAWS Secret Manager)\n- PHI sanitization layer with pattern detection\n- HIPAA-compliant audit logging\n- Webhook signature verification with replay protection\n- Data retention compliance with automated cleanup\n\n## Error Handling\n| Security Issue | Detection | Mitigation |\n|----------------|-----------|------------|\n| Exposed API key | Git scanning alert | Rotate immediately, audit access |\n| PHI in query | Log pattern matching | Block request, alert compliance |\n| Failed signature | Webhook verification | Reject webhook, alert security |\n| Unauthorized access | Audit log review | Revoke access, investigate |\n\n## Examples\n\n### Secure Query Flow\n```typescript\nconst sanitized = sanitizeQueryForOpenEvidence(question, patientContext);\nconst response = await client.query({ question: sanitized.question, context: sanitized.context });\nawait auditLogger.logClinicalQuery(user.id, user.role, response.id, true, request);\n```\n\nSee [detailed implementation](${CLAUDE_SKILL_DIR}\u002Freferences\u002Fimplementation.md) for advanced patterns.\n\n## Resources\n- [OpenEvidence Security](https:\u002F\u002Fwww.openevidence.com\u002Fsecurity)\n- [HIPAA Security Rule](https:\u002F\u002Fwww.hhs.gov\u002Fhipaa\u002Ffor-professionals\u002Fsecurity\u002Findex.html)\n- [NIST Cybersecurity Framework](https:\u002F\u002Fwww.nist.gov\u002Fcyberframework)",{"name":5,"author":43,"license":14,"version":44,"description":45,"allowed-tools":46,"compatible-with":47},"Jeremy Longshore \u003Cjeremy@intentsolutions.io>","1.0.0","Apply OpenEvidence security best practices for HIPAA compliance and PHI protection.\nUse when securing API keys, implementing PHI handling,\nor auditing OpenEvidence security configuration.\nTrigger with phrases like \"openevidence security\", \"openevidence hipaa\",\n\"openevidence phi\", \"secure openevidence\", \"openevidence compliance\".\n","Read, Write, Grep","claude-code, codex, openclaw","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","claude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Fopenevidence-pack\u002Fskills\u002Fopenevidence-security-basics",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add micsapp\u002Fmicstec-skills --skill openevidence-security-basics",{"tool":61,"command":62},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill openevidence-security-basics",{"tool":64,"command":65},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill openevidence-security-basics","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Fopenevidence-pack\u002Fskills\u002Fopenevidence-security-basics\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fimplementation.md","REFERENCE","参考文档",2314,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fclaude-code\u002Fplugins-plus-skills\u002Fplugins\u002Fsaas-packs\u002Fopenevidence-pack\u002Fskills\u002Fopenevidence-security-basics\u002Freferences\u002Fimplementation.md",[76,111,139,158,178,203],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":92,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[82,87],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[93,94,95,96,97,98,99,100,101,31,102,103,104,105,106,107,108,109,110,22],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":125,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[117,118,121,124],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":119,"categoryName":120,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":122,"categoryName":123,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[126,127,128,129,94,130,35,131,132,133,134,135,31,102,108,136,137,109,138,23],"deployment","apiops deployment","workflows","azure devops","infrastructure","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[145],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},[147,148,149,18,94,97,31,102,150,28,151,152,153,154,155,109,156,157,23,22],"policy","authoring","apim policy authoring","access","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":166,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[164,165],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":88,"categoryName":89,"taxonomyType":90,"taxonomyTypeDesc":91},[167,18,168,31,152,169,94,126,170,171,172,173,102,174,109,175,176,177,110,22],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[185,186,187,128,188,189,190,191,31,192,193,194,195,196,197,198,199,200,201,202],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":209,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[205,210,211,212,213,214,215,28,216,217],"npm","js","calculate","node","math","user","compute","errors"]