healthcare-data-interoplisted

# Healthcare data interop (validated, de-identified) Build healthcare-data pipelines and **prove** the data is well-formed and stripped of PHI — correctness is gated by scripts that run (FHIR/HL7 validation, PHI scan, DICOM de-id + verify), not by assertion. ## Core principle **Validity and de-identification are measured, not claimed.** The loop is: scan/validate → fix the root cause → re-validate, until the gate is green; then a human reviews what the automation cannot decide. **Be honest about scope (this is the rule that keeps the skill correct):** - **De-identification reduces, but does not eliminate, re-identification risk.** HIPAA gives two paths — **Safe Harbor** (remove the 18 identifiers) and **Expert Determination** (a qualified statistician certifies low risk). GDPR distinguishes true **anonymization** (irreversible, out of scope of GDPR) from **pseudonymization** (reversible, still personal data). State which you are doing. → `references/02-deidentification.md` - The scripts handle **header/structured PHI only**. They do **not** touch **burned-in pixel PHI** in images, and the regex scan does **not** reliably catch **names or free-text PHI**. - **Structural FHIR validation ≠ profile conformance.** A green structural run does not prove US Core / IG conformance; that needs a real validator. This skill is **engineering assistance, not a clinical or regulatory sign-off.** ## When to use vs. not - Use for: validating FHIR R4 / HL7 v2 messages; d