dsh-industry-medical: A Healthcare-Specific Self-Check Plugin for DeepSeek Harness

What Does It Do?

It is a DSH plugin for DeepSeek Harness that performs a static self-check against the requirements unique to healthcare IT projects — the points general security tooling never inspects but healthcare assessments always ask about. It targets problems such as medical records kept shorter than the statutory period, prescriptions retained too briefly, record edits with no audit trail, missing medical-device cybersecurity policies, face login without a non-face alternative, and genetics projects lacking ethics approval. The plugin only flags suspicious points for human confirmation; it does not declare a project compliant or non-compliant.

Core Features

• Retention checks for records and prescriptions: flags retention statements below 15 years for outpatient and 30 years for inpatient records, prescriptions below the one-year legal minimum, and record tables with no retention statement at all.
• Audit-trail inspection: detects record tables or entities missing operator, version, or trace fields, and projects with neither a dedicated operation log table nor framework-level auditing.
• Medical-device and budget rules: covers full-lifecycle cybersecurity policies for medical devices, the 5% cybersecurity budget for new projects, and cybersecurity clauses in outsourcing contracts.
• Face recognition and human genetic resources: checks whether face login offers a non-face alternative and whether genetics projects can produce ethics review and informed consent materials.
• Clause-based findings: 8 criteria and 11 rules, each citing only the clause number and key points so teams can confirm items one by one before an assessment.

How to Use This Plugin?

After enabling it in DSH, run the self-check against a healthcare IT project directory; it scans rule by rule and lists each hit with its severity level. Work through the results to confirm retention statements, audit fields, policy documents, and ethics approvals, and fill in whatever is missing. It deliberately covers only the extra healthcare-specific items — baseline compliance, vulnerabilities, dependencies, and secrets belong to other DSH plugins, and the set is complete only when used together.

How to Troubleshoot This Plugin?

A rule hit is not a violation verdict, only a prompt to confirm: first verify whether the corresponding tables, configuration, or policy files actually exist, then decide whether material is missing or the rule is a false positive. If a hit seems inapplicable, check the clause scope per the official documentation; final applicability rests with the competent authority's interpretation.