Agent skill · security · jeremylongshore
openevidence-security-basics
Assess OpenEvidence security claims and institution-specific controls using current first-party evidence and accountable review. Use when working with OpenEvidence in a healthcare organization. Trigger with "openevidence security basics", "OpenEvidence security", or a matching workflow request.
Why this skill is useful
Adds executable scripts for HIPAA compliance and security best practices specific to OpenEvidence that the AI wouldn't generate on its own.
What it needs
Requires openevidence account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
OpenEvidence Security and Contract Due Diligence Overview Separate public vendor assertions from the controls and commitments actually governing the institution’s use. Keep inputs minimal, separate observed facts from assumptions, and leave consequential decisions with the named accountable owner. Prerequisites A clearly bounded workflow, accountable clinical owner, and organizational policy Current first-party OpenEvidence documentation and applicable institution agreements Synthetic or properly authorized minimum-necessary data Tool Discipline Use Read, Glob, and Grep to inspect supplied policies, plans, and evidence. Use WebFetch only for current first-party OpenEvidence documentation. Use Write or Edit only when the user requests a named deliverable with an approved destination. Never expose credentials, PHI, recordings, or unrestricted environment output. Current Contract The public security page states HIPAA handling, SOC 2 Type II, encryption in transit and at rest, annual penetration testing, and a disclosure contact. The Trust Center provides current security-program evidence, while access to detailed artifacts may be controlled. Institution commitments are governed by applicable MSA, BAA, SLA, and other written agreements. Authentication Use only the official OpenEvidence web/mobile sign-in or an institution-approved access path. Do not invent API keys, OAuth clients, SDK credentials, service accounts, or private endpoints. Never ask a user to reveal a password, session token, cookie, or recovery code. Instructions 1. Scope workflow, users, data classes, recording, communications, devices, exports, and downstream systems. 2. Collect the dated security page, Trust Center evidence, terms/privacy, and current institution agreements. 3. Map vendor claims and contract commitments separately to required controls; mark absent evidence unknown. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/openevidence-security-basics