Agent skill · security · jeremylongshore
abridge-security-basics
Apply HIPAA-compliant security practices for Abridge clinical AI integrations.
Why this skill is useful
Includes executable scripts for HIPAA-compliant security practices and specific implementation details for PHI protection.
What it needs
Requires openssl installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Abridge Security Basics Overview HIPAA-compliant security configuration for Abridge clinical AI integrations. Abridge handles PHI (Protected Health Information) — security is not optional. This skill covers encryption, access control, audit logging, and BAA requirements. HIPAA Security Checklist Requirement Implementation Status ------------- --------------- -------- Encryption in transit TLS 1.3 enforced Required Encryption at rest AES-256 for stored PHI Required Access control Role-based with MFA Required Audit logging All PHI access logged Required BAA signed Business Associate Agreement Required Minimum necessary Only access needed PHI Required Breach notification 60-day notification plan Required Prerequisites A signed BAA, documented data-flow inventory, and organization-approved retention and incident-response policies. A non-production environment with synthetic fixtures for security testing; never use real PHI to exercise logging, authorization, or TLS controls. Named owners for security, privacy, clinical operations, and the EHR integration who can approve or block a release. Instructions Step 1: Enforce TLS and Certificate Pinning Step 2: PHI-Safe Audit Logger Step 3: Role-Based Access Control Step 4: Secrets Management Output TLS 1.3 enforcement with optional cert pinning HIPAA-compliant audit logger with PHI leak detection Role-based access control matrix Secrets loaded from cloud secret manager Examples In a sandbox release check, call a protected endpoint as the integrationservice role using a secret-manager-supplied credential and create an audit entry containing a fictional session ID. Verify TLS policy, the authorization outcome, and that the log contains no patient name, note content, MRN, or token. Then attempt an unauthorized export and confirm the RBAC layer refuses it with a redacted audit record. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/abridge-security-basics