"use strict";
/**
 * HITECH per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for HITECH-scoped compliance narratives.
 *
 * References:
 *   Health Information Technology for Economic and Clinical Health Act (2009)
 *   42 U.S.C. 17921-17954 -- HITECH enforcement provisions
 *   45 CFR Part 160 Subparts C, D, E -- Enforcement Rule (as amended by HITECH)
 *   ONC Health IT Certification Program
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.HITECH_PROMPT_SPEC = void 0;
exports.HITECH_PROMPT_SPEC = {
    frameworkId: 'hitech',
    frameworkName: 'HITECH Act',
    version: '42 U.S.C. 17921-17954 (2009, as amended)',
    sections: [
        {
            sectionId: 'hitech-17921-meaningful-use',
            heading: 'Meaningful Use and EHR Certification',
            regulatoryRef: '42 U.S.C. 17921 / 45 CFR 170 Subpart C',
            requiredEventTypes: ['agent:registered', 'governance:verdict'],
            controlMappings: [
                '42 U.S.C. 17921 -- Health IT standards adoption',
                '45 CFR 170.302 -- Certified EHR technology functional requirements',
                'ONC 2015 Edition -- Certification criteria for health information exchange',
                'HL7 FHIR R4 -- Interoperability requirements for certified HIT',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Describe how the AI governance platform supports meaningful use objectives. ' +
                'Address certified health IT integration controls, data interoperability enforcement, ' +
                'and access logging for electronic health record interactions. Note any AI agent ' +
                'registrations or governance verdicts relevant to health data access.',
        },
        {
            sectionId: 'hitech-17935-accounting-disclosures',
            heading: '17935 Accounting of Disclosures',
            regulatoryRef: '42 U.S.C. 17935 / 45 CFR 164.528',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                '42 U.S.C. 17935(c) -- Accounting of disclosures through EHR systems',
                '45 CFR 164.528 -- Individual right to accounting of disclosures',
                'HITECH 13405(c) -- Six-year disclosure accounting window',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document AI agent disclosure events involving protected health information. ' +
                'For each governance verdict or access-denial event, identify whether ePHI was in scope, ' +
                'which agent requested access, and the enforcement outcome. Quantify the total disclosure ' +
                'attempts, denied requests, and any approved disclosures with their stated purpose. ' +
                'This section feeds the 45 CFR 164.528 accounting obligation.',
        },
        {
            sectionId: 'hitech-17936-minimum-necessary',
            heading: '17936 Minimum Necessary Standard',
            regulatoryRef: '42 U.S.C. 17936 / 45 CFR 164.502(b)',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                '42 U.S.C. 17936 -- Minimum necessary standard for AI-accessed PHI',
                '45 CFR 164.502(b) -- Minimum necessary use and disclosure',
                '45 CFR 164.514(d) -- Implementation specifications for minimum necessary',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Demonstrate enforcement of the minimum necessary standard against AI agent data requests. ' +
                'Cite governance verdict events showing that agents were restricted to the minimum ' +
                'PHI scope needed for each task. Include deny-decision counts where access was refused ' +
                'as exceeding minimum necessary scope. Identify any access patterns that warrant review.',
        },
        {
            sectionId: 'hitech-17937-notification',
            heading: '17937 Breach Notification Strengthening',
            regulatoryRef: '42 U.S.C. 17937 / 45 CFR 164.400-414',
            requiredEventTypes: ['incident:created'],
            controlMappings: [
                '42 U.S.C. 17937 -- Strengthened breach notification under HITECH',
                '45 CFR 164.402 -- Definition of breach under HITECH standard',
                '45 CFR 164.404 -- Notification to individuals (60-day window)',
                '45 CFR 164.406 -- Notification to media for 500+ individual breaches',
                '45 CFR 164.408 -- Notification to HHS Secretary',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Summarise breach notification status under HITECH strengthened requirements. ' +
                'For any incident events, determine whether a HITECH breach occurred under the ' +
                '4-factor harm assessment. Document notification timelines against the 60-day ' +
                'statutory window. If no qualifying breach occurred, document this with chain evidence ' +
                'showing the absence of qualifying incident events in the review period.',
        },
        {
            sectionId: 'hitech-17945-enforcement',
            heading: '17945 Increased Penalties and Enforcement',
            regulatoryRef: '42 U.S.C. 17945 / 45 CFR 160 Subparts C-E',
            requiredEventTypes: ['governance:verdict', 'incident:created'],
            controlMappings: [
                '42 U.S.C. 17945 -- Tiered civil monetary penalties',
                '45 CFR 160.404 -- Amount of civil money penalty (up to $1.9M per category)',
                '45 CFR 160.408 -- Factors considered in determining penalty amount',
                '45 CFR 164.530(j) -- Documentation retention (6 years)',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Document controls that mitigate HITECH penalty exposure. Describe the governance ' +
                "platform's documentation retention posture (meeting the 6-year requirement), " +
                'corrective action program evidence, and any wilfulness-prevention controls. ' +
                'Reference governance verdicts demonstrating systematic rather than ad-hoc enforcement, ' +
                'which supports the "reasonable cause" penalty tier rather than "wilful neglect".',
        },
    ],
};
//# sourceMappingURL=hitech.js.map