"use strict";
/**
 * HITECH Act Compliance Pack
 *
 * Health Information Technology for Economic and Clinical Health Act
 * (2009), as amended by:
 *   - The HIPAA Omnibus Rule (2013): makes Business Associates and
 *     their subcontractors directly liable for HIPAA compliance.
 *   - HR 7898 (Jan 2021): Safe-harbour law requiring HHS to consider
 *     12+ months of recognised security practices (NIST CSF, HITRUST,
 *     §405(d) HICP) when assessing fines and audit remedies.
 *
 * HITECH always activates alongside HIPAA. The governance runtime
 * blocks HITECH activation without HIPAA active. Merged policy uses
 * HIPAA's encryption, PHI detection, and retention, and layers
 * HITECH-specific workflows on top:
 *   - 60-day breach notification clock (individuals + HHS; 500+
 *     records also media in the jurisdiction).
 *   - Annual HHS small-breach report by 1 March of the following year.
 *   - BA chain tracking (subcontractors of BAs must themselves have
 *     BAAs with the BA).
 *   - Tiered penalty classification (1-4) for every violation.
 *   - Recognised-security-practices attestation register for HR 7898
 *     mitigation.
 *   - Sale of PHI / marketing-use authorisation gating.
 *
 * Authority: HHS Office for Civil Rights (OCR).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.HITECH_PACK = exports.HITECH_CATEGORY_CLASSIFIERS = void 0;
const _base_classifiers_1 = require("./_base-classifiers");
/**
 * HITECH category classifiers.
 * HITECH layers BA chain + breach clock + penalty tier on top of HIPAA.
 * This pack governs process flows; PHI/CREDENTIALS classification
 * is shared with HIPAA (HITECH always activates alongside HIPAA).
 */
exports.HITECH_CATEGORY_CLASSIFIERS = {
    PHI: {
        references: ['HITECH Act §13402 -- unsecured PHI breach notification; 45 CFR 164.400-414'],
        // HITECH explicitly extends HIPAA (§13402 cross-references 45 CFR 164.400-414).
        // The PHI definition is identical to HIPAA's 18 Safe Harbor identifiers.
        // sharedPhiClassifier implements those 18 identifiers; no copy-paste needed.
        classifier: (input) => {
            if ((0, _base_classifiers_1.sharedPhiClassifier)(input))
                return true;
            if (/\b(?:patient|diagnosis|prescription|medical record|health condition|clinical)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['HITECH Act §13401 -- security requirements for BA; 45 CFR 164.312(a)'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.HITECH_PACK = {
    categoryClassifiers: exports.HITECH_CATEGORY_CLASSIFIERS,
    /** P3.5: PHI is inherently subject-keyed (HITECH extends HIPAA BA chain; same §164.528 obligation). */
    subjectKeyedCategories: ['PHI'],
    id: 'hitech',
    name: 'HITECH Act',
    version: '1.0.0',
    description: 'HITECH Act (2009) as amended by the HIPAA Omnibus Rule (2013) and HR 7898 Safe Harbor Law (2021). Extends HIPAA to Business Associates and their subcontractors, adds 60-day breach notification with 500+ media escalation, tiered civil penalties up to ~$2M/year per category, and recognised-security-practices safe harbor. Always activates alongside HIPAA.',
    authority: 'HHS Office for Civil Rights (OCR)',
    industries: ['healthcare', 'health-it', 'business-associates', 'telehealth', 'pharma', 'insurance'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce HITECH tier classification and BA chain gating',
            reference: '2013 HIPAA Omnibus Rule -- BA direct liability',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit trail for breach clock and OCR audit evidence',
            reference: '45 CFR 164.312(b); HR 7898 evidence continuity',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Unsecured-PHI detection requires encryption status; unencrypted PHI triggers breach presumption',
            reference: '45 CFR 164.402 (breach definition) -- "unsecured PHI"',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'PHI detection for breach counting and sale-of-PHI / marketing gating',
            reference: '45 CFR 164.502(a)(5)(ii), 164.508(a)(3)',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Unique agent identification for audit trail and tier classification',
            reference: '45 CFR 164.312(a)(2)(i)',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Breach clock and affected-individual count must survive restarts',
            reference: '45 CFR 164.404, 164.408',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach events, tier-escalation events, BA-chain changes',
            reference: '45 CFR 164.404',
        },
        {
            name: 'anomaly-detector',
            required: true,
            reason: 'Detect PHI exfiltration patterns that may constitute an unreported breach',
            reference: '45 CFR 164.308(a)(1)(ii)(D) -- information system activity review',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'BA chain register: each BA subcontractor needs its own BAA',
            reference: '45 CFR 164.502(e)(1)(ii)',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Sale of PHI and marketing use require individual authorisation approval',
            reference: '45 CFR 164.508(a)(3), 13405(d)',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Recognised-security-practices attestation register for HR 7898 Safe Harbor',
            reference: 'HR 7898 (Jan 2021); HHS factors to consider 405(d) HICP / NIST CSF / HITRUST',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            requiresPacks: ['hipaa'],
            tierClassificationActive: true,
        },
        'session-persistence': {
            breachClockTrackingDays: 60,
            breachThresholdForMediaNotice: 500,
        },
        'approval-queue': {
            phiSaleRequiresAuthorisation: true,
            phiMarketingRequiresAuthorisation: true,
        },
        'attestation-manager': {
            recognisedSecurityPracticesFrameworks: ['nist_csf', 'hitrust', 'hicp_405d'],
            recognisedSecurityPracticesMinimumMonths: 12,
        },
        'supply-chain': {
            baChainTrackingRequired: true,
            subcontractorBaaRequired: true,
        },
    },
    providerPolicy: {
        // HITECH inherits HIPAA provider restrictions (no BAA => blocked)
        blockedProviders: ['deepseek', 'baidu', 'alibaba', 'meta', 'mistral'],
        requiredCapabilities: ['BAA'],
        blockReasons: {
            deepseek: 'No BAA available. PRC jurisdiction; PHI transfer prohibited for covered entities and BAs.',
            baidu: 'No BAA available. PRC jurisdiction.',
            alibaba: 'No BAA available. PRC jurisdiction.',
            meta: 'No BAA available for Llama-hosted endpoints.',
            mistral: 'No standard BAA available at the time of publication; confirm directly with provider.',
        },
    },
    dataPolicy: {
        scanCategories: ['PHI', 'CREDENTIALS'],
        categoryActions: {
            PHI: 'BLOCK', // unsecured PHI specifically; HIPAA encryption permits secured flow
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        sovereignty: ['US'],
        // 6 years to align with HIPAA Privacy Rule documentation retention
        auditLogRetentionDays: 2190,
        sessionRetentionDays: 365,
        incidentRetentionDays: 2190,
        reference: '45 CFR 164.530(j) (HIPAA Privacy Rule documentation); HITECH incident evidence retained alongside.',
    },
    incidentPolicy: {
        // 60 days for individual + HHS notification
        notificationDeadlineHours: 1440,
        reference: '45 CFR 164.404 (individuals), 164.406 (media for 500+ records in a state/jurisdiction), 164.408 (HHS; <500 records reported annually by 1 March).',
        requiredRecipients: [
            'affected-individuals',
            'hhs-ocr',
            'prominent-media-if-500-plus',
            'privacy-officer',
            'security-officer',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'hitech-hipaa-pair',
            description: 'HITECH activated only when HIPAA is also active',
            reference: '2013 Omnibus Rule pairing',
            check: 'hitech_hipaa_paired',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hitech-breach-clock',
            description: '60-day breach notification clock tracked per incident',
            reference: '45 CFR 164.404',
            check: 'breach_clock_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hitech-500-threshold',
            description: '500+ affected-individual threshold triggers media + immediate HHS escalation',
            reference: '45 CFR 164.406, 164.408',
            check: 'breach_500_escalation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hitech-annual-hhs',
            description: 'Annual HHS small-breach report scheduled by 1 March of the following year',
            reference: '45 CFR 164.408(c)',
            check: 'annual_hhs_report_scheduled',
            failSeverity: 'HIGH',
        },
        {
            id: 'hitech-ba-chain',
            description: 'BA chain (BA + subcontractors) tracked with BAAs at every link',
            reference: '45 CFR 164.502(e)(1)(ii)',
            check: 'ba_chain_tracked',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hitech-tier-classifier',
            description: 'Violations classified into Tier 1-4 (did not know / reasonable cause / willful neglect corrected / willful neglect not corrected)',
            reference: '42 USC 1320d-5',
            check: 'penalty_tier_classifier_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'hitech-unsecured-phi',
            description: 'Unsecured PHI detection triggers breach presumption workflow',
            reference: '45 CFR 164.402',
            check: 'unsecured_phi_detector_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hitech-phi-sale',
            description: 'Sale of PHI blocked without individual authorisation',
            reference: '45 CFR 164.502(a)(5)(ii), 13405(d)',
            check: 'phi_sale_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'hitech-phi-marketing',
            description: 'Marketing use of PHI blocked without individual authorisation',
            reference: '45 CFR 164.508(a)(3)',
            check: 'phi_marketing_gate_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'hitech-hr7898',
            description: 'Recognised-security-practices attestation present for 12+ months (HR 7898 Safe Harbor)',
            reference: 'HR 7898 (Jan 2021)',
            check: 'recognised_security_practices_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'hitech-ocr-audit-ready',
            description: 'OCR audit evidence bundle exportable on demand',
            reference: 'OCR audit protocol',
            check: 'ocr_audit_ready',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=hitech.js.map