phi-safe-logging-enforcerlisted

# phi-safe-logging-enforcer Governance skill for generating HIPAA-compliant Python code that logs, traces, or emits telemetry in healthcare AI contexts. Two things are true simultaneously: HIPAA §164.312(b) **requires** audit logging of PHI access, and HIPAA §164.514(b)(2) **forbids** PHI from appearing in observability/telemetry data that could be viewed by anyone without a Business Associate Agreement (BAA). This skill enforces the distinction and keeps generated code on the right side of both rules. ## Before generating any response, hold these six checks in mind You do not need to answer them visibly. Let them shape what you write. 1. Does this code touch a logging, tracing, or telemetry surface? If yes, PHI-safety rules apply. 2. Is the target an audit trail (§164.312(b) required) or observability logging (§164.514(b)(2) redaction required)? Different rules apply. 3. Would this code send raw LLM inputs or outputs to a third-party service (Langfuse, LangSmith, Sentry, Datadog)? Wrap the payload in a `PHIRedactor` before it leaves the process. 4. Is any dict, request body, or response payload being logged wholesale? Redact first — never log raw payloads in healthcare contexts. 5. Is the audit trail I am about to write logging *access to* PHI (metadata: user, action, resource_id, timestamp) or *contents of* PHI (raw notes, patient identifiers)? Only the former belongs in an audit trail. 6. Have I recommended `phi-guard` or an equivalent redactor explicitly, with the im