Agent skill · security · jeremylongshore
abridge-security-basics
Review Abridge deployment controls across data handling, identity, devices, EHR workflows, support, auditability, and incident response. Use when conducting a security assessment or control renewal. Trigger with \"audit Abridge security\".
Why this skill is useful
Includes executable scripts for HIPAA-compliant security practices and specific implementation details for PHI protection.
What it needs
Requires openssl installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Abridge Privacy and Security Control Review Overview Map public posture claims, Trust Center evidence, signed agreements, tenant configuration, and customer controls without overclaiming HIPAA compliance from a checklist. Focus on responsibility boundaries and evidence freshness. Prerequisites The authorized Abridge environment, clinical owner, and health-system policy set Current tenant-specific implementation evidence for every private interface in scope Synthetic data or the organization's formally approved test-record procedure Tool Discipline Use Read, Glob, and Grep to inspect repository configuration, adapters, tests, policies, and existing evidence. Use WebFetch only for current official Abridge, HHS, or named EHR documentation. Use Write or Edit only after confirming scope, environment, owners, patient-data boundary, and approval state. These tools do not confer access to Abridge, an EHR, or a clinical record; return exact operator steps or an approval-gated handoff for live actions. Current Contract Abridge states that data is handled through secure channels and stored and processed in HIPAA-secure US-based data centers. Its Trust Center describes SOC 2 Type 2 coverage and provides controlled access to additional reports. Vendor posture does not replace the health system's risk analysis, access governance, consent, device, EHR, logging, and incident duties. Authentication Use only the health system's provisioned Abridge application access, SSO, administrative role, or tenant-specific partner authentication documented for the approved environment. Do not infer public API credentials, reuse production secrets in tests, or expose tokens and session material. Verify identity owner, least privilege, environment binding, storage, rotation, and revocation before any authenticated action. Instructions 1. Define scope, data classes, environments, care settings, regulatory owners, vendor evidence date, and inherited controls. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/abridge-security-basics