Plan for privacy and compliance
Install this skill
npx skills add StanfordSpezi/SpeziVibe --skill digital-health-compliance-planning
Or install all skills: npx skills add StanfordSpezi/SpeziVibe --skill '*'. See the Getting Started guide for tool-specific options.
Explore this skill in browser chat. Each button opens a new conversation; bring any earlier briefs with you and save the results yourself.
Need to paste the prompt yourself?
Browser prompt for digital-health-compliance-planning
Please act as the SpeziVibe `digital-health-compliance-planning` skill and walk me through it interactively.
STEP 1 — Fetch the skill instructions from this URL and read them carefully:
https://raw.githubusercontent.com/StanfordSpezi/SpeziVibe/main/skills/digital-health-compliance-planning/SKILL.md
If the skill references other files or other skills by name, fetch them from the same repository:
- Files inside this skill (e.g. `references/foo.md`): https://raw.githubusercontent.com/StanfordSpezi/SpeziVibe/main/skills/digital-health-compliance-planning/<relative-path>
- Other skills (e.g. `biodesign-needs-finding`): https://raw.githubusercontent.com/StanfordSpezi/SpeziVibe/main/skills/<skill-name>/SKILL.md
STEP 3 — Walk me through the skill interactively. When a step would normally save a markdown file to a project, show the file content in a code block instead so I can copy it. Don't simulate my answers — wait for me to respond.
If you cannot fetch the skill instructions or their reference files, ask me to paste them before proceeding.
Ask me to paste or attach any existing briefs you need. Do not claim to have read files, run commands, created a project, or tested an integration from this chat. Help me prepare the decisions and instructions, then hand off file and code work to my coding tool.If your chat can’t open the skill link, open the instructions in a new tab and paste them into the chat.
Helps you reason through which compliance domains apply to your project and what controls you should consider. Framework-agnostic — recommends capabilities, not specific implementations.
Domains Assessed
Each is marked as likely, possible, or unlikely for your project:
- HIPAA or institutional privacy
- IRB or human subjects review
- FDA or Software as a Medical Device (SaMD)
- GDPR or other regional privacy
- Enterprise/academic security review
Output
Produces docs/planning/compliance-brief.md containing:
- Scope summary (product, users, jurisdictions, data categories)
- Domain applicability assessment
- Key risks (unclear claims, unnecessary data collection, missing consent, vendor gaps)
- Required decisions
- Recommended controls (access control, encryption, audit logging, consent capture, export/deletion)
Example
AI: Before diving into compliance domains — what does the product
actually do? Who uses it, and what data does it collect?
You: It's a cardiac rehab app that tracks exercise, collects
patient-reported outcomes, and shares summaries with
the care team.
AI: A few follow-ups:
— Is this for a research study or direct clinical care?
— Does it recommend exercise intensity or just track it?
— Are you at a HIPAA-covered entity like a hospital?
You: Research study at Stanford. It recommends exercise targets
based on the patient's care plan.
AI: Here's my initial assessment:
✅ HIPAA — Likely. PHI at a covered entity.
✅ IRB — Likely. Research study with human subjects.
⚠️ FDA — Possible. Exercise recommendations based on
clinical data may qualify as clinical decision support.
Needs legal review.
❌ GDPR — Unlikely. US-only participants.
The FDA question is the one I'd flag to counsel first.
Limitations
- Not legal advice — distinguishes product guidance from counsel that requires legal review
- Does not perform a full compliance audit
- Prefers "you likely need to evaluate" over "you must" unless the requirement is well-established
- Flags when local counsel, IRB staff, or compliance officers need to review