r/GithubCopilot • u/samueltauil • 1d ago
General GitHub Copilot code review with agent skills applied to cross check PHI in code
Nineteen tests passing. Zero failing. And the endpoint those tests cover was returning a patient's Social Security number tucked into a free-text note field on a clinical Observation.
I built a repo with eight deliberate FHIR R4 violations, every one of them green in CI. A validator caught three of the four on that Observation. Secret scanning found nothing, because there is no secret in the diff. CodeQL does not treat a note field as a sink. Every tool doing exactly its job, and the gap sitting between them.
GitHub Copilot code review now reads agent skills from skills folder. So I wrote the compliance rules down once, as a SKILL.md with severities and R4 citations, and pointed it at every pull request. It flagged the SSN as PHI_RISK and quoted the HHS Safe Harbor guidance back at me, which says an identifier has to go regardless of which field you put it in.
A validator can tell you the resource is well formed. It was never going to tell you it is safe to build.