QME AI Hero
GitHub About
STAGE 01 · SAFE ENVIRONMENT
/qme-env-audit

Audit your QME AI setup before using real case data.

This skill helps you see exactly where case data goes, what can be independently verified right now, and what needs fixing before you rely on the environment for real evaluations.

Install /qme-env-audit View on GitHub
  1. Download the skill (qme-env-audit.zip)
  2. In Claude, open Settings → Capabilities → Skills and upload the zip.
  3. Start a new chat and type /qme-env-audit.
Needs a Claude Pro, Max, Team, or Enterprise plan with code execution enabled. Run the audit before you put any real case data into that account — the audit itself will tell you whether the account is fit for it.

What good looks like

Identity Storage Model Output Retention Recovery
  1. 01Each person has an individual identity — no shared logins.
  2. 02Case data stays inside a known, bounded environment.
  3. 03Model and vendor access is explicit, not assumed.
  4. 04PHI does not leak through convenience tools like email or chat.
  5. 05Retention and deletion are intentional, not accidental.
  6. 06Backups and recovery are understood before they are needed.
Full methodology in GitHub / docs.

How the skill works

It asks one question at a time, and keeps a hard line between what's verified, what's reported, and what's still unknown — an assumption is never quietly converted into a pass.

  1. Know the boundary
    Map where case data enters, moves, and lives.
  2. Verify
    Separate what’s proven from what’s merely stated.
  3. Fix
    Address the highest-priority gaps first.
  4. Re-check
    Confirm the fix actually closed the gap.
AUDIT OUTPUT · /qme-env-audit P0
HIGH — PHI may be exposed through external email
Status: VERIFIED
EVIDENCE
Completion messages include patient identifiers in external email bodies.
WHY IT MATTERS
This creates an unnecessary PHI egress path outside any controlled boundary.
RECOMMENDED ACTION
Remove patient identifiers from email and require authenticated access for case materials.
Priority: P0 · Contain → Consolidate → Harden → Verify → Scale
One finding among many the skill produces from a single environment scan. Example output.

Choose your operating model

Both paths meet the same operational standard. The only question is who carries the operational responsibility.

SELF-OPERATED

Run it in your environment

You own the infrastructure and controls.
You manage storage, access, and retention.
You wire up integrations yourself.
The open skill remains fully usable.
MANAGED TRESA

Managed by Tresa

Same operational standard as above.
Infrastructure and controls operated for you.
Storage, access, retention handled continuously.
You still see what's verified and what isn't.
See the managed implementation →
Next → Master the Record coming

Turn a packet of records into a reliable understanding of the case.

AI can organize and challenge the evidence. The physician owns the medicine.