"use strict";
/**
 * HIPAA Security Incident Report Template
 *
 * Covers 45 CFR 164.308(a)(6) -- Security Incident Procedures.
 * Distinct from Breach Notification (164.404): this template documents
 * the investigation and response to a security incident regardless of
 * whether PHI was compromised (i.e., covers failed attempts as well as
 * confirmed breaches).
 *
 * Regulatory references:
 *   45 CFR 164.308(a)(6)(i) -- Security incident procedures (Required)
 *   45 CFR 164.308(a)(6)(ii) -- Response and reporting (Required)
 *   45 CFR 164.308(a)(1)(ii)(D) -- Information system activity review
 *   45 CFR 164.312(b) -- Audit controls
 *   NIST SP 800-61 Rev 2 -- Computer Security Incident Handling Guide
 *
 * Required audit event types:
 *   governance:verdict[DENY] -- a denied governance decision (policy trigger)
 *   security:anomaly-detected -- anomaly detection fired
 *   approval:escalated -- incident escalated for human review
 *
 * Spec: P4-AIR-02 item 3
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.HIPAA_SECURITY_INCIDENT_TEMPLATE = void 0;
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is insufficient, write
"Insufficient evidence in the audit window; supplemental documentation required
under 45 CFR 164.308(a)(6)." Never fabricate event IDs.
`.trim();
exports.HIPAA_SECURITY_INCIDENT_TEMPLATE = {
    templateId: 'tpl-hipaa-security-incident-v1',
    name: 'HIPAA Security Incident Report (45 CFR 164.308(a)(6))',
    framework: 'hipaa',
    requiredAuditEventTypes: [
        'governance:verdict',
        'security:anomaly-detected',
        'approval:escalated',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'hipaa-si-incident-identification',
            title: '1. Incident Identification and Classification (164.308(a)(6)(i))',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Incident Identification section for a HIPAA Security
Incident Report under 45 CFR 164.308(a)(6)(i).

A "security incident" under HIPAA means the attempted or successful unauthorized
access, use, disclosure, modification, or destruction of information or
interference with system operations in an information system.

Using ONLY the audit-chain events provided, describe:
1. The governance verdict events (DENY decisions) that triggered incident
   classification -- cite each by event ID, timestamp, and the AI agent involved.
2. The anomaly-detection alert(s) that corroborated the incident assessment.
3. Incident classification: attempted vs. successful; type (unauthorized access,
   use, disclosure, modification, destruction, or interference).
4. Whether the incident involved unsecured PHI (which may trigger Breach
   Notification under 164.400-414).

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs. Use the NIST SP 800-61 lifecycle terminology
(Preparation, Detection, Analysis, Containment, Eradication, Recovery).
`.trim(),
        },
        {
            id: 'hipaa-si-audit-trail',
            title: '2. Audit Trail Review (45 CFR 164.308(a)(1)(ii)(D) + 164.312(b))',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Audit Trail Review section for a HIPAA Security Incident
Report.

45 CFR 164.312(b) requires covered entities to implement hardware, software,
and procedural mechanisms that record and examine activity in systems containing
or using ePHI. 164.308(a)(1)(ii)(D) requires procedures to regularly review
records of information system activity.

Using ONLY the audit-chain events provided, describe:
1. The scope of the audit trail reviewed: time window, agent IDs, and system
   components covered.
2. Key activity patterns observed in the chain that are relevant to the incident
   (access patterns, tool invocations, governance decisions).
3. Any gaps in the audit trail (missing event types, time gaps, hash-chain
   breaks) and their significance.
4. How the tamper-evident chain ensures the audit records have not been
   altered since the incident occurred.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'hipaa-si-response-actions',
            title: '3. Response and Containment Actions (164.308(a)(6)(ii))',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Response and Containment section for a HIPAA Security
Incident Report under 45 CFR 164.308(a)(6)(ii) (identify and respond to
suspected or known security incidents; mitigate harmful effects; document
incidents and their outcomes).

Using ONLY the audit-chain events provided, describe:
1. Automated containment actions taken by the governance runtime (circuit
   breakers opened, agents suspended, tool access revoked).
2. Human escalation events: when the incident was escalated, to whom, and the
   documented human decision.
3. Mitigation steps taken to reduce the harmful effects of the incident.
4. Whether ePHI access, use, or disclosure was contained or whether it
   requires further breach-notification analysis.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'hipaa-si-root-cause',
            title: '4. Root Cause Analysis and Control Gaps',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Root Cause Analysis section for a HIPAA Security Incident
Report. Under 45 CFR 164.308(a)(1) (risk analysis) and 164.308(a)(8) (periodic
evaluation), covered entities must document gaps identified during incidents.

Using ONLY the audit-chain events provided, describe:
1. The root cause of the incident based on audit-chain evidence (policy gap,
   misconfigured AI agent, external attack vector, insider misuse, etc.).
2. Contributing factors: which governance controls were absent or bypassed.
3. Any policy violations (governance:verdict[DENY] patterns) that indicate a
   systemic rather than isolated control failure.
4. Recommended corrective controls tied to specific audit-chain evidence.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'hipaa-si-documentation',
            title: '5. Incident Documentation and Retention (45 CFR 164.414)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Incident Documentation section for a HIPAA Security
Incident Report. 45 CFR 164.414(a) requires documentation to be retained for
six years from the date of creation or the date it was last in effect.

Using ONLY the audit-chain events provided, describe:
1. The complete set of audit-chain entries that form the contemporaneous record
   for this incident.
2. Retention classification applied to these records (six-year minimum required).
3. Whether legal hold was placed on any records in connection with this incident.
4. Who reviewed and signed off on the incident record (cite approval events).

${CITATION_INSTRUCTION}

Write 3-4 formal paragraphs.
`.trim(),
        },
    ],
};
//# sourceMappingURL=hipaa-security-incident.js.map