health-docs
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
ChineseHealthcare System Documentation
医疗保健系统文档
Overview
概述
Healthcare engineering systems require documentation that serves multiple audiences simultaneously — developers, operators, auditors, AI agents, and regulators. That documentation rarely exists in a usable state: it's scattered across README files, inline comments, AGENTS.md, and external wikis, with critical regulatory-required content simply absent.
This skill audits what exists, maps it to what's required given the system's regulatory context, and consolidates it into a structured, maintainable hierarchy.
医疗保健工程系统需要同时面向多类受众的文档——开发人员、运维人员、审计人员、AI Agent和监管机构。但这类文档通常都不具备可用状态:分散在README文件、行内注释、AGENTS.md、外部维基中,监管要求的关键内容甚至直接缺失。
本Skill可以审计现有文档,结合系统的监管背景映射所需内容,将其整合为结构化、可维护的层级结构。
Modes
模式
Mode: analyze
模式:分析
Scan the repository, detect applicable regulatory regimes, assess documentation coverage across seven dimensions, and produce a structured handoff artifact. No repository files are modified — only is written.
.health-docs/analysis.md扫描代码仓库,检测适用的监管体系,评估七个维度的文档覆盖率,生成结构化交接工件。不会修改仓库中的任何文件,仅写入。
.health-docs/analysis.mdMode: document
模式:文档生成
Read the handoff artifact from analyze mode, conduct an evidence-informed interview to confirm requirements, then consolidate existing documentation into the target hierarchy and draft new content for required gaps. Confirms before writing.
读取分析模式生成的交接工件,开展基于证据的访谈确认需求,之后将现有文档整合到目标层级结构中,并为缺失的必填内容撰写草稿。写入前会先确认。
Operating Rules
操作规则
- Never modify code, tests, configurations, or infrastructure files.
- Never silently resolve conflicts between documentation sources — always flag for human resolution.
- Always mark documents in directories with
comply/regardless of operation type (consolidate, merge, or draft new) — the skill can transcribe and draft from evidence, but cannot certify compliance.⚠ REQUIRES HUMAN REVIEW - If a relevant subagent is unavailable, fall back to direct analysis for that dimension; note reduced confidence in the artifact.
- Treat external links (Confluence, Notion, GDrive) as "unverifiable — content not assessed" — mark coverage as partial, not covered.
- The directory is the skill's work directory in the target repo. Do not treat it as part of the documentation hierarchy.
.health-docs/ - Credential redaction: Before consolidating or copying any content, scan for secrets, API keys, tokens, passwords, private keys, and credentials. Do not reproduce secret material — replace with and note each redaction in the run record. If a file appears to be an environment file (
[REDACTED — potential secret at <source-path>:<line>],.env,.env.*,secrets.*) or contains only key-value credential pairs, skip it entirely and note it in the run record rather than consolidating it.credentials.*
- 永远不要修改代码、测试、配置或基础设施文件。
- 永远不要静默解决不同文档来源之间的冲突——始终标记出来供人工解决。
- 无论操作类型是整合、合并还是新起草,始终为目录下的文档标记
comply/——本Skill可以基于证据转录和起草内容,但无法证明合规性。⚠ 需要人工审核 - 如果相关子代理不可用,回退到对该维度的直接分析,并在工件中注明置信度降低。
- 将外部链接(Confluence、Notion、GDrive)视为“不可验证——内容未评估”——标记为部分覆盖,而非未覆盖。
- 目录是本Skill在目标仓库中的工作目录,不要将其视为文档层级结构的一部分。
.health-docs/ - 凭证脱敏:在整合或复制任何内容前,扫描密钥、API密钥、令牌、密码、私钥和凭证信息。不要复制敏感内容,替换为,并在运行记录中记录每一处脱敏。如果文件看起来是环境文件(
[已脱敏——潜在敏感内容位于 <源路径>:<行号>]、.env、.env.*、secrets.*)或仅包含键值对形式的凭证,直接跳过该文件并在运行记录中注明,不要整合其内容。credentials.*
Analyze Mode Workflow
分析模式工作流
Pass 1: Broad Scan and Regime Signal Detection
第1步:广泛扫描和监管体系信号检测
Inventory the repository without subagents:
- Find all markdown files at every level ()
**/*.md - Find all agent instruction files: ,
AGENTS.md,.github/copilot-instructions.md,.cursor/rules,.cursorrulesCLAUDE.md - Find CI/CD configs: ,
.github/workflows/,Jenkinsfile,.circleci/Makefile - Detect existing documentation root: search for ,
docs/,documentation/,wiki/in that precedence order. Select the first match by precedence (not filesystem order). If multiple directories exist, note the others in the artifact narrative. Recorddoc/innullif none are found.doc_root_detected - Scan code and configuration for regime signals using :
references/regime-signals.md- PHI signals → HIPAA candidate (record confidence level and specific evidence)
- ONC/EHR API signals → ONC candidate
- SaMD/AI clinical signals → FDA SaMD candidate
- Record all external links found in documentation (flag as unverifiable)
不使用子代理清点仓库内容:
- 查找所有层级的markdown文件()
**/*.md - 查找所有Agent指令文件:、
AGENTS.md、.github/copilot-instructions.md、.cursor/rules、.cursorrulesCLAUDE.md - 查找CI/CD配置:、
.github/workflows/、Jenkinsfile、.circleci/Makefile - 检测现有文档根目录:按优先级顺序搜索、
docs/、documentation/、wiki/,选择优先级最高的第一个匹配项(而非文件系统顺序)。如果存在多个目录,在工件描述中注明其他目录。如果未找到任何匹配,在doc/中记录doc_root_detected。null - 使用扫描代码和配置中的监管体系信号:
references/regime-signals.md- PHI信号 → 候选HIPAA合规(记录置信度和具体证据)
- ONC/EHR API信号 → 候选ONC合规
- SaMD/AI临床信号 → 候选FDA SaMD合规
- 记录文档中发现的所有外部链接(标记为不可验证)
Pass 2: Parallel Subagent Dispatch
第2步:并行调度子代理
Invoke available subagents in parallel against the Pass 1 file inventory. Dispatch only those relevant to detected signals:
| Subagent | Condition | Invocation | Coverage dimensions fed |
|---|---|---|---|
| PHI signals found (see | "scoped review" + file list | |
| FHIR or ONC signals found (FHIR resource types, SMART auth, EHR SDK imports, USCDI references) | "scoped review" + file list | |
| UI source files found ( | "scoped review" + file list | |
If a subagent is not installed: perform direct analysis for that dimension and note in the artifact.
confidence: reducedTranslating subagent findings to coverage dimensions:
Each subagent returns a findings report. Translate to coverage dimensions using this mapping:
| Subagent | Finding type | Coverage dimension |
|---|---|---|
| Access control / session management gaps | |
| Audit log / retention gaps | |
| Encryption at-rest or in-transit gaps | |
| Risk analysis / risk management gaps | |
| BAA / business associate documentation gaps | |
| Integration / vendor API documentation gaps | |
| SMART / bulk API access documentation gaps | |
| Missing usability test docs / acceptance criteria | |
For any finding that does not map to a row above, record the gap verbatim in the narrative and assign the closest matching dimension with .
confidence: reduced针对第1步清点的文件列表,并行调用可用的子代理。仅调度与检测到的信号相关的子代理:
| 子代理 | 触发条件 | 调用参数 | 覆盖维度 |
|---|---|---|---|
| 检测到PHI信号(参见 | "范围审查" + 文件列表 | |
| 检测到FHIR或ONC信号(FHIR资源类型、SMART认证、EHR SDK导入、USCDI引用) | "范围审查" + 文件列表 | |
| 检测到UI源文件( | "范围审查" + 文件列表 | |
如果子代理未安装:对该维度执行直接分析,并在工件中注明(置信度降低)。
confidence: reduced将子代理的发现结果映射到覆盖维度:
每个子代理都会返回发现报告,使用如下映射关系转换为覆盖维度:
| 子代理 | 发现类型 | 覆盖维度 |
|---|---|---|
| 访问控制/会话管理缺口 | |
| 审计日志/留存缺口 | |
| 静态加密/传输加密缺口 | |
| 风险分析/风险管理缺口 | |
| BAA/业务合作方文档缺口 | |
| 集成/供应商API文档缺口 | |
| SMART/批量API访问文档缺口 | |
| 缺失可用性测试文档/验收标准 | |
对于任何无法映射到上述条目的发现,在描述中逐字记录缺口,并分配最匹配的维度,同时标注。
confidence: reducedPass 3: Synthesize Coverage Matrix
第3步:合成覆盖率矩阵
For each documentation dimension in , assign a coverage status:
references/doc-hierarchy.md| Status | Meaning |
|---|---|
| Exists, appears current and complete |
| Exists but stale, thin, or incomplete — note what's missing |
| Multiple sources cover the topic with contradictory content |
| No evidence found in the repository |
| Absent and mandated by applicable regulation |
Enumerate every dimension listed in in the coverage matrix — including dimensions. Do not omit covered entries. The complete matrix allows document mode to present an accurate inclusion/skip list to the user.
references/doc-hierarchy.mdcoveredFor each dimension, record:
- : canonical ID matching the file path slug (e.g.,
dimension,secure/audit-logs)operate/runbooks/breach-notification - : one of the above
status - : file paths and line ranges where related content was found (empty if absent)
sources - : applicable regulation and section (from
regulatory), orreferences/regulatory-mapping.mdif nonenull - :
required— populated by document mode after the interviewnull - :
confidence,high, ormedium(reduced if subagent was unavailable)reduced
对于中的每个文档维度,分配覆盖状态:
references/doc-hierarchy.md| 状态 | 含义 |
|---|---|
| 内容存在,看起来是最新且完整的 |
| 内容存在,但过时、单薄或不完整——注明缺失内容 |
| 多个来源覆盖同一主题,但内容相互矛盾 |
| 在仓库中未找到相关证据 |
| 内容缺失且属于适用法规强制要求 |
在覆盖率矩阵中枚举中列出的所有维度——包括的维度,不要省略已覆盖的条目。完整的矩阵可以让文档模式向用户展示准确的包含/跳过列表。
references/doc-hierarchy.mdcovered每个维度需要记录:
- :与文件路径slug匹配的标准ID(例如
dimension、secure/audit-logs)operate/runbooks/breach-notification - :上述状态之一
status - :找到相关内容的文件路径和行范围(如果缺失则为空)
sources - :适用的法规和条款(来自
regulatory),如果没有则为references/regulatory-mapping.mdnull - :
required——文档模式在访谈后填充null - :
confidence(高)、high(中)或medium(降低)(如果子代理不可用则为降低)reduced
Write Handoff Artifact
写入交接工件
Write with:
.health-docs/analysis.md- YAML frontmatter containing the structured coverage matrix (see Artifact Schema below)
- Human-readable narrative body:
- Regime detection summary with evidence
- Coverage findings organized by dimension
- Conflicts and their sources
- External links flagged as unverifiable
- Priority gaps (absent-required items listed first)
写入,包含以下内容:
.health-docs/analysis.md- YAML frontmatter,包含结构化覆盖率矩阵(参见下方工件 schema)
- 人类可读的描述正文:
- 监管体系检测摘要及证据
- 按维度组织的覆盖率发现结果
- 冲突及其来源
- 标记为不可验证的外部链接
- 优先级缺口(必填缺失项排在最前面)
Document Mode Workflow
文档模式工作流
Step 1: Read Handoff Artifact
第1步:读取交接工件
Read . If it does not exist, tell the user to run analyze mode first.
.health-docs/analysis.mdCheck the timestamp. If older than 90 days, warn the user that the analysis may be stale and recommend re-running analyze mode before proceeding.
generated_atIf a profile already exists in the artifact (from a previous document mode run), present it to the user and ask whether to use it or re-interview.
requirements读取,如果文件不存在,告知用户先运行分析模式。
.health-docs/analysis.md检查时间戳,如果超过90天,警告用户分析可能已过时,建议先重新运行分析模式再继续。
generated_at如果工件中已经存在配置文件(来自之前的文档模式运行),向用户展示并询问是使用该配置还是重新访谈。
requirementsStep 2: Evidence-Informed Interview (3 Confirmations)
第2步:基于证据的访谈(3项确认)
Present findings from the artifact and ask the user to confirm, not discover.
Confirmation 1 — Regime:
Present the regime signals found with evidence and confidence levels. Example:
"I found these indicators: Patient model with MRN and DOB fields (src/models/patient.rb), FHIR R4 resources in src/fhir/, 'phi' in 14 variable names. I'm proposing HIPAA track. Correct?"
Confirmation 2 — Dimension inclusion:
Show a fast-scan list of each dimension with proposed status (INCLUDE / SKIP / REVIEW). The user can override any entry. Mark regulatory-required dimensions that are absent as .
INCLUDE ⚠ requiredConfirmation 3 — Target directory:
- If an existing documentation directory was detected in Pass 1, inform (no confirmation required): "Writing to — your existing documentation root. Say otherwise to override." Do not wait for a response.
[detected-root]/ - If no documentation directory was detected, require a response: "No documentation directory found. I'll create . Use a different path?"
docs/
展示工件中的发现结果,要求用户确认,而非让用户自主发现。
确认1——监管体系:
展示检测到的监管体系信号、证据和置信度。示例:
"我发现了以下指标:包含MRN和DOB字段的患者模型(src/models/patient.rb)、src/fhir/目录下的FHIR R4资源、14个变量名中包含'phi'。我建议采用HIPAA跟踪,是否正确?"
确认2——维度包含:
展示每个维度的快速扫描列表及建议状态(包含/跳过/审核)。用户可以覆盖任何条目。将缺失的监管必填维度标记为。
包含 ⚠ 必填确认3——目标目录:
- 如果在第1步中检测到现有文档目录,告知用户(无需确认):"将写入——您的现有文档根目录。如需覆盖请说明。"无需等待响应。
[检测到的根目录]/ - 如果未检测到文档目录,需要用户响应:"未找到文档目录,我将创建,是否需要使用其他路径?"
docs/
Step 3: Write Requirements Profile
第3步:写入需求配置文件
Write the confirmed values for each dimension back into frontmatter. This persists across sessions — future document mode runs skip the interview unless overridden.
required: true/false.health-docs/analysis.md将每个维度确认后的值写回的frontmatter中。该配置会跨会话保留——未来的文档模式运行会跳过访谈,除非用户覆盖。
required: true/false.health-docs/analysis.mdStep 4: Pre-Flight Confirmation
第4步:前置确认
Before writing any files, show the full plan:
CONSOLIDATE (copying to target path — no rewrites; originals flagged in place):
README.md:12-45 → docs/orient/README.md
AGENTS.md:23-31 → docs/agent-context/phi-rules.md
MERGE (combining sources — conflicts flagged for your review):
README.md:78-85 ⚠ CONFLICT → docs/secure/auth-model.md
AGENTS.md:23-31 (session timeout description differs)
DRAFT NEW (no existing source — requires human review where noted):
docs/operate/runbooks/breach-notification.md ← HIPAA §164.408 ⚠ REVIEW
docs/comply/hipaa/risk-analysis.md ← HIPAA §164.308 ⚠ REVIEW
SKIP (not required by your profile):
docs/comply/onc/
docs/comply/fda/
Proceed? [yes / no / edit plan]Do not write any files until the user confirms.
在写入任何文件前,展示完整计划:
整合(复制到目标路径——不重写;原文件会被标记):
README.md:12-45 → docs/orient/README.md
AGENTS.md:23-31 → docs/agent-context/phi-rules.md
合并(合并多个来源——冲突会标记供您审核):
README.md:78-85 ⚠ 冲突 → docs/secure/auth-model.md
AGENTS.md:23-31 (会话超时描述不一致)
新起草(无现有来源——标注位置需要人工审核):
docs/operate/runbooks/breach-notification.md ← HIPAA §164.408 ⚠ 需审核
docs/comply/hipaa/risk-analysis.md ← HIPAA §164.308 ⚠ 需审核
跳过(您的配置中未要求):
docs/comply/onc/
docs/comply/fda/
是否继续? [是 / 否 / 编辑计划]用户确认前不要写入任何文件。
Step 5: Execute Plan
第5步:执行计划
Execute in strict order:
- Consolidate — copy content from source locations to target paths. Do not rewrite — preserve substance, fix location. Do not delete the source file; the flag-originals step handles that. Add header to any
⚠ REQUIRES HUMAN REVIEWtarget file. Apply credential redaction before writing (see Operating Rules).comply/ - Merge — when multiple sources cover the same topic, merge them into the target file. Insert a visible conflict marker where descriptions differ:
Add
<!-- ⚠ CONFLICT: session timeout described as 30min in README.md and 60min in AGENTS.md. Resolve before treating this document as authoritative. -->header to any⚠ REQUIRES HUMAN REVIEWtarget file.comply/ - Draft new — generate content for required dimensions with no source. Ground drafts in codebase evidence where possible. Add header to all
⚠ REQUIRES HUMAN REVIEWdocuments.comply/ - Flag originals — add a comment or note to original file locations indicating content was copied to the new path. Do not delete originals.
严格按顺序执行:
- 整合——将内容从源位置复制到目标路径。不要重写内容,保留实质,仅调整位置。不要删除源文件,标记原文件步骤会处理。为所有目标文件添加
comply/头部。写入前应用凭证脱敏规则(参见操作规则)。⚠ 需要人工审核 - 合并——当多个来源覆盖同一主题时,将其合并到目标文件中。在描述不一致的位置插入可见的冲突标记:
为所有
<!-- ⚠ 冲突:README.md中描述会话超时为30分钟,AGENTS.md中描述为60分钟。将此文档作为权威版本前请先解决冲突。 -->目标文件添加comply/头部。⚠ 需要人工审核 - 新起草——为没有源内容的必填维度生成内容。尽可能基于代码库证据生成草稿。为所有文档添加
comply/头部。⚠ 需要人工审核 - 标记原文件——在原文件位置添加评论或注释,说明内容已复制到新路径。不要删除原文件。
Step 6: Update Run Record
第6步:更新运行记录
Append a dated entry to recording:
.health-docs/runs/YYYY-MM-DD.md- What was consolidated (source → target)
- What was merged (sources → target, conflicts noted)
- What was drafted (path, regulatory basis)
- What was skipped
- Any human review items outstanding
在中追加带日期的条目,记录:
.health-docs/runs/YYYY-MM-DD.md- 整合的内容(源→目标)
- 合并的内容(源→目标,注明冲突)
- 新起草的内容(路径、监管依据)
- 跳过的内容
- 所有待处理的人工审核项
Handoff Artifact Schema
交接工件Schema
The file uses YAML frontmatter for structured data and a markdown body for human narrative.
.health-docs/analysis.mdyaml
---
generated_at: "2026-03-28T14:00:00Z"
schema_version: "1"
regime_detected:
hipaa:
proposed: true
confidence: high
evidence:
- "Patient model with mrn, dob fields (src/models/patient.rb:12)"
- "'phi' in 14 variable names"
onc:
proposed: true
confidence: medium
evidence:
- "SMART on FHIR scopes in config/oauth.yml"
fda_samd:
proposed: false
confidence: low
evidence: []
doc_root_detected: "docs/" # null if not found
coverage:
- dimension: "understand/data-flows"
status: "absent-required"
sources: []
regulatory: "HIPAA §164.308(a)(1)(ii)(A)"
required: null # populated by document mode
confidence: high
- dimension: "secure/audit-logs"
status: "partial"
sources:
- path: "README.md"
lines: "45-60"
note: "mentions audit logging exists but no schema or retention policy"
regulatory: "HIPAA §164.312(b)"
required: null
confidence: high
- dimension: "comply/hipaa/baa-inventory"
status: "absent-required"
sources: []
regulatory: "HIPAA §164.308(b)(1)"
required: null
confidence: high
requirements: # populated after document mode interview
interview_completed_at: null # ISO 8601 timestamp, null until interview complete
regime: [] # confirmed regimes (e.g., ["hipaa", "onc"])
dimensions: {} # dimension path → true/false
human_review_required: [] # file paths requiring human sign-off
---.health-docs/analysis.mdyaml
---
generated_at: "2026-03-28T14:00:00Z"
schema_version: "1"
regime_detected:
hipaa:
proposed: true
confidence: high
evidence:
- "Patient model with mrn, dob fields (src/models/patient.rb:12)"
- "'phi' in 14 variable names"
onc:
proposed: true
confidence: medium
evidence:
- "SMART on FHIR scopes in config/oauth.yml"
fda_samd:
proposed: false
confidence: low
evidence: []
doc_root_detected: "docs/" # 未找到则为null
coverage:
- dimension: "understand/data-flows"
status: "absent-required"
sources: []
regulatory: "HIPAA §164.308(a)(1)(ii)(A)"
required: null # 文档模式填充
confidence: high
- dimension: "secure/audit-logs"
status: "partial"
sources:
- path: "README.md"
lines: "45-60"
note: "mentions audit logging exists but no schema or retention policy"
regulatory: "HIPAA §164.312(b)"
required: null
confidence: high
- dimension: "comply/hipaa/baa-inventory"
status: "absent-required"
sources: []
regulatory: "HIPAA §164.308(b)(1)"
required: null
confidence: high
requirements: # 文档模式访谈后填充
interview_completed_at: null # ISO 8601时间戳,访谈完成前为null
regime: [] # 确认的监管体系(例如["hipaa", "onc"])
dimensions: {} # 维度路径 → true/false
human_review_required: [] # 需要人工签字确认的文件路径
---Resources
资源
- : canonical seven-dimension documentation tree with target file paths, audience notes, and minimum required files
references/doc-hierarchy.md - : PHI, ONC, and FDA SaMD signal patterns for Pass 1 detection
references/regime-signals.md - : dimension → regulatory requirement mapping with classification (required / addressable / recommended)
references/regulatory-mapping.md - : sample analyze mode output narrative
examples/example-analysis.md - : sample
examples/example-analysis-artifact.mdshowing YAML structure pre- and post-interview.health-docs/analysis.md
- :标准七维度文档树,包含目标文件路径、受众说明和最低要求文件
references/doc-hierarchy.md - :第1步检测用的PHI、ONC和FDA SaMD信号模式
references/regime-signals.md - :维度→监管要求映射,包含分类(必填/可寻址/推荐)
references/regulatory-mapping.md - :分析模式输出描述示例
examples/example-analysis.md - :
examples/example-analysis-artifact.md示例,展示访谈前后的YAML结构.health-docs/analysis.md
Output Contract
输出契约
Analyze mode
分析模式
- Writes with YAML frontmatter (coverage matrix) and human narrative
.health-docs/analysis.md - No other files written
- 写入包含YAML frontmatter(覆盖率矩阵)和人类可读描述的
.health-docs/analysis.md - 不写入其他任何文件
Document mode
文档模式
- Writes or updates files within the target documentation directory
- Updates with requirements profile
.health-docs/analysis.md - Appends to with run record
.health-docs/runs/YYYY-MM-DD.md - Does not modify code, tests, or configurations
- Does not delete original files — flags them for human-reviewed cleanup
- 在目标文档目录内写入或更新文件
- 用需求配置文件更新
.health-docs/analysis.md - 向追加运行记录
.health-docs/runs/YYYY-MM-DD.md - 不修改代码、测试或配置
- 不删除原文件——仅标记供人工审核后清理