"use strict";
/**
 * Caldicott Principles Compliance Pack
 *
 * Framework:
 *   The Caldicott Principles (eight, 2020 revision) — the UK's foundational
 *   principles for handling patient confidential information across health
 *   and adult social care. Originally published as six principles (Caldicott
 *   Review 1997), expanded to seven (Caldicott Review 2 / Information
 *   Governance Review 2013), and finalised at eight in the 2020 revision
 *   under the National Data Guardian.
 *
 *   The Caldicott Guardian is the named role inside each NHS organisation
 *   (and many adult-social-care organisations) responsible for ensuring
 *   patient confidential information is handled in line with the
 *   principles. The Caldicott Guardian Manual (NHS England, current
 *   edition) sets the operational expectations.
 *
 * Jurisdiction: GB — England-led; equivalent practice in Scotland, Wales,
 *   and Northern Ireland under their devolved health bodies.
 * Authority: National Data Guardian (NDG, statutory under Health and Social
 *   Care (National Data Guardian) Act 2018) + Caldicott Guardian (named
 *   role within each organisation) + UK Caldicott Guardian Council
 *   (UKCGC, professional support body)
 *
 * The Eight Caldicott Principles (2020 revision):
 *   1. Justify the purpose(s) for using confidential information
 *   2. Use confidential information only when it is necessary
 *   3. Use the minimum necessary confidential information
 *   4. Access to confidential information should be on a strict
 *      need-to-know basis
 *   5. Everyone with access to confidential information should be aware
 *      of their responsibilities
 *   6. Comply with the law (UK GDPR, DPA 2018, Common Law Duty of
 *      Confidentiality, statutory duty to share, etc.)
 *   7. The duty to share information for individual care is as important
 *      as the duty to protect patient confidentiality
 *   8. Inform patients and service users about how their confidential
 *      information is used
 *
 * Why this pack:
 *   - Required of every NHS organisation and any supplier processing
 *     patient confidential information for direct care purposes; widely
 *     adopted in adult social care.
 *   - DTAC pack (PR #404) currently captures Caldicott Guardian
 *     designation as a transitional measure
 *     (`caldicottHandlingMode: 'TRANSITIONAL_LOCAL'`). When this
 *     standalone pack is registered alongside DTAC, DTAC defers
 *     Caldicott enforcement to this pack. NHS DSPT pack (PR #395)
 *     similarly references Caldicott Guardian sign-off — the role-
 *     designation now has a single source of truth.
 *   - Pairs with: NHS DSPT (data security baseline), nhs-clinical-safety
 *     (DCB0129/0160), uk-gdpr (Article 6/9 lawful basis), and DTAC
 *     (composite assessment).
 *
 * Distinction from UK GDPR pack:
 *   - UK GDPR governs all personal-data handling (NHS or otherwise).
 *   - Caldicott governs the additional NHS-specific obligations on
 *     confidential patient information including the duty-to-share
 *     side (principle 7) which is not present in UK GDPR. A processor
 *     handling NHS patient data needs BOTH packs active.
 *
 * Out of scope:
 *   - Data security technical baseline (separate pack: nhs-dspt)
 *   - Clinical safety case (separate pack: nhs-clinical-safety)
 *   - SaMD UKCA marking (separate pack: mhra-samd-ukca)
 *   - General UK personal-data handling (separate pack: uk-gdpr)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CALDICOTT_PRINCIPLES_PACK = exports.CALDICOTT_CATEGORY_CLASSIFIERS = void 0;
/**
 * Caldicott category classifiers.
 *
 * Pack scope is the Caldicott-evidence layer: justification records,
 * Caldicott Guardian sign-off, need-to-know access decisions, duty-to-
 * share decisions, patient-facing transparency artefacts. Underlying
 * NHS-data classification (NHS Number, SNOMED-CT, ICD-10) is delegated
 * to the nhs-dspt pack; UK GDPR personal-data classification is
 * delegated to the uk-gdpr pack.
 */
exports.CALDICOTT_CATEGORY_CLASSIFIERS = {
    PURPOSE_JUSTIFICATION: {
        references: [
            'Caldicott Principle 1: Justify the purpose(s) for using confidential information',
            'Caldicott Principle 2: Use confidential information only when it is necessary',
        ],
        classifier: (input) => {
            if (/\b(?:purpose\s+(?:justification|of\s+use|for\s+access)|caldicott\s+principle\s+1)\b/i.test(input))
                return true;
            if (/\b(?:lawful\s+basis\s+caldicott|necessity\s+test|why\s+do\s+we\s+need\s+this\s+(?:patient|confidential)\s+information)\b/i.test(input))
                return true;
            return false;
        },
    },
    MINIMUM_NECESSARY_DECISION: {
        references: [
            'Caldicott Principle 3: Use the minimum necessary confidential information',
        ],
        classifier: (input) => {
            if (/\b(?:minimum\s+necessary|min[\s-]?necessary\s+(?:check|decision|review))\b/i.test(input))
                return true;
            if (/\b(?:data\s+minimisation\s+(?:nhs|caldicott)|fields\s+(?:redacted|removed|excluded))\b/i.test(input))
                return true;
            return false;
        },
    },
    NEED_TO_KNOW_ACCESS: {
        references: [
            'Caldicott Principle 4: Access to confidential information should be on a strict need-to-know basis',
        ],
        classifier: (input) => {
            if (/\b(?:need[\s-]?to[\s-]?know\s+(?:access|decision|justification)|ntk\s+gate)\b/i.test(input))
                return true;
            if (/\b(?:role[\s-]?based\s+access\s+caldicott|smartcard\s+role|role\s+profile\s+nhs)\b/i.test(input))
                return true;
            return false;
        },
    },
    DUTY_TO_SHARE: {
        references: [
            'Caldicott Principle 7: The duty to share information for individual care is as important as the duty to protect patient confidentiality',
        ],
        classifier: (input) => {
            if (/\b(?:duty[\s-]?to[\s-]?share|principle\s+7\s+caldicott|share\s+for\s+(?:individual|direct)\s+care)\b/i.test(input))
                return true;
            if (/\b(?:cross[\s-]?(?:trust|provider|organisation)\s+share|interoperability\s+share\s+decision)\b/i.test(input))
                return true;
            return false;
        },
    },
    CALDICOTT_GUARDIAN_DESIGNATION: {
        references: [
            'Caldicott Guardian Manual (NHS England) — designation requirements',
            'UK Caldicott Guardian Council (UKCGC) registration',
        ],
        classifier: (input) => {
            if (/\b(?:caldicott\s+guardian\s+(?:designation|named|appointed|delegation|registration)|cg\s+sign[\s-]?off)\b/i.test(input))
                return true;
            if (/\b(?:ukcgc\s+register|caldicott\s+log\s+entry|caldicott\s+council)\b/i.test(input))
                return true;
            return false;
        },
    },
    PATIENT_TRANSPARENCY: {
        references: [
            'Caldicott Principle 8: Inform patients and service users about how their confidential information is used',
            'NHS Privacy Notice + Patient Information Standard',
        ],
        classifier: (input) => {
            if (/\b(?:patient[\s-]?facing\s+(?:notice|disclosure|information)|nhs\s+privacy\s+notice|fair\s+processing\s+notice)\b/i.test(input))
                return true;
            if (/\b(?:national\s+data\s+opt[\s-]?out|type\s+1\s+opt[\s-]?out|patient\s+information\s+standard)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; Caldicott Guardian artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.CALDICOTT_PRINCIPLES_PACK = {
    categoryClassifiers: exports.CALDICOTT_CATEGORY_CLASSIFIERS,
    id: 'caldicott-principles',
    aliases: [
        'caldicott',
        'caldicott-principles-2020',
        'caldicott-guardian',
        'ndg-caldicott',
        'uk-caldicott',
    ],
    name: 'Caldicott Principles (2020 revision)',
    version: '1.0.0',
    description: 'Caldicott Principles eight (2020 revision) covering NHS-specific patient confidential information handling: purpose justification, necessity test, minimum-necessary decisions, need-to-know access gating, role awareness, lawful-basis compliance, duty-to-share for individual care (principle 7), and patient-facing transparency. Caldicott Guardian named-role designation captured here as the single source of truth — NHS DSPT pack (PR #395) and DTAC pack (PR #404) both defer to this pack for Caldicott Guardian sign-off when this pack is registered. Pairs with UK GDPR (general personal-data handling), NHS DSPT (technical security baseline), nhs-clinical-safety (clinical safety case), and DTAC (composite assessment).',
    authority: 'National Data Guardian (NDG, statutory under Health and Social Care (National Data Guardian) Act 2018) + Caldicott Guardian (named role) + UK Caldicott Guardian Council (UKCGC)',
    industries: ['healthcare', 'pharma', 'public-sector', 'social-care', 'digital-health', 'clinical-research'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Caldicott Principle 1 (justify purpose) + Principle 2 (only when necessary) + Principle 3 (minimum necessary) form a default-deny gate on patient confidential information access. Every access path must carry a recorded purpose and necessity rationale.',
            reference: 'Caldicott Principles 1-3, 2020 revision',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Caldicott Principle 4 need-to-know enforcement: role-based access binding to NHS smartcard / role profile; access denied unless caller has the role + need-to-know justification on the record.',
            reference: 'Caldicott Principle 4; NHS Identity and Access Management standard',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Caldicott Guardian (T2 named-role) sign-off gate on (a) non-routine sharing, (b) cross-trust transfers, (c) duty-to-share decisions where consent is absent, (d) cross-organisation interoperability shares.',
            reference: 'Caldicott Principles 6 + 7; Caldicott Guardian Manual sign-off requirements',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for purpose justification records, Caldicott Guardian sign-off events, need-to-know access decisions, duty-to-share decisions, and patient-facing transparency artefact versions.',
            reference: 'Caldicott Principle 5 (awareness of responsibilities); UK GDPR Art. 5(2) accountability overlay',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Caldicott Guardian designation (named role + UKCGC registration) tracked; per-organisation Caldicott Guardian record; annual training attestation for staff with patient-data access.',
            reference: 'Caldicott Guardian Manual; UKCGC registration',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface Caldicott-specific evidence categories for the audit trail and the Caldicott Guardian dashboard; cross-pack overlap with nhs-dspt (NHS Number / clinical codes) and uk-gdpr (PII) for cross-pack reporting.',
            reference: 'Caldicott Principles operational evidence',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Caldicott Principle 8: patient-facing transparency. NHS Privacy Notice publication, National Data Opt-Out compliance, patient-information-standard surface for AI-generated outputs.',
            reference: 'Caldicott Principle 8; National Data Opt-Out policy 2018',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Caldicott Guardian notification events (non-routine sharing requests, duty-to-share decisions, cross-organisation transfers); aggregate metric for the Caldicott Guardian annual report to the SIRO.',
            reference: 'Caldicott Guardian Manual annual report obligations',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Purpose-justification records and Caldicott Guardian sign-offs retained alongside the underlying clinical record (8-year clinical record default per nhs-dspt pack; 25-year paediatric / 30-year maternity overrides on the underlying record).',
            reference: 'NHS Records Management Code of Practice 2021; UK GDPR Art. 5(1)(e)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Caldicott Principle 6 lawful-basis compliance flows down to processors; sub-supplier Caldicott posture recorded.',
            reference: 'Caldicott Principle 6; UK GDPR Art. 28',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            caldicottPrinciple1JustifyPurposeRequired: true,
            caldicottPrinciple2NecessityTestRequired: true,
            caldicottPrinciple3MinimumNecessaryEnforced: true,
        },
        'agent-auth': {
            caldicottPrinciple4NeedToKnowGateRequired: true,
            nhsSmartcardRoleBindingSupported: true,
            accessDenialOnMissingNeedToKnow: true,
        },
        'approval-queue': {
            caldicottGuardianSignOffRequired: true,
            nonRoutineSharingApprovalRequired: true,
            crossTrustTransferApprovalRequired: true,
            dutyToShareDecisionApprovalRequired: true,
            reviewTier: 'T2',
            reviewerCompetence: 'CALDICOTT_GUARDIAN',
        },
        'attestation-manager': {
            caldicottGuardianDesignationTracked: true,
            ukcgcRegistrationTracked: true,
            annualTrainingAttestationRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'PURPOSE_JUSTIFICATION',
                'MINIMUM_NECESSARY_DECISION',
                'NEED_TO_KNOW_ACCESS',
                'DUTY_TO_SHARE',
                'CALDICOTT_GUARDIAN_DESIGNATION',
                'PATIENT_TRANSPARENCY',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'transparency-injector': {
            caldicottPrinciple8TransparencyRequired: true,
            nhsPrivacyNoticePublicationRequired: true,
            nationalDataOptOutHonoured: true,
        },
        'event-bus': {
            caldicottGuardianNotificationsRoutingRequired: true,
            annualReportAggregationRequired: true,
        },
        'audit-integrity': {
            tamperEvidentRequired: true,
        },
        'session-persistence': {
            retentionAlignmentWithUnderlyingClinicalRecord: true,
        },
        'supply-chain': {
            processorCaldicottPostureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'NHS-DSPT-SUBSCRIBED'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. Patient confidential information must reside in UK or adequate jurisdiction; PRC routing is incompatible with Caldicott Principle 6 lawful-basis compliance for NHS data.',
            baidu: 'PRC jurisdiction. NHS patient confidential information cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. NHS patient confidential information cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'PURPOSE_JUSTIFICATION',
            'MINIMUM_NECESSARY_DECISION',
            'NEED_TO_KNOW_ACCESS',
            'DUTY_TO_SHARE',
            'CALDICOTT_GUARDIAN_DESIGNATION',
            'PATIENT_TRANSPARENCY',
            'CREDENTIALS',
        ],
        categoryActions: {
            PURPOSE_JUSTIFICATION: 'WARN',
            MINIMUM_NECESSARY_DECISION: 'WARN',
            NEED_TO_KNOW_ACCESS: 'WARN',
            DUTY_TO_SHARE: 'WARN',
            CALDICOTT_GUARDIAN_DESIGNATION: 'WARN',
            PATIENT_TRANSPARENCY: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // Caldicott evidence is held alongside the underlying clinical record:
        // 8-year adult clinical default per nhs-dspt + Records Management Code of
        // Practice 2021. Paediatric (25-year) and maternity (30-year) overrides
        // ride on the clinical-record metadata.
        auditLogRetentionDays: 2920, // 8 years
        sessionRetentionDays: 2920,
        incidentRetentionDays: 2920,
        reference: 'Aligned with NHS Records Management Code of Practice 2021; Caldicott audit alongside clinical record',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb'],
    },
    incidentPolicy: {
        // No standalone Caldicott notification window; defers to UK GDPR Art. 33
        // (72-hour ICO) when personal data breach, NHS DSPT CareCERT for cyber
        // incidents, and PSIRF for clinical-safety incidents. Caldicott Guardian
        // notification is mandatory in parallel.
        notificationDeadlineHours: 72,
        reference: 'UK GDPR Art. 33 (72-hour ICO) overlay; NHS DSPT CareCERT; PSIRF; Caldicott Guardian parallel notification',
        requiredRecipients: [
            'caldicott-guardian',
            'data-protection-officer',
            'senior-information-risk-owner',
            'ico',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'caldicott-purpose-justification',
            description: 'Every patient-confidential-information access path carries a recorded purpose justification and necessity-test outcome.',
            reference: 'Caldicott Principles 1 + 2',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'caldicott-minimum-necessary',
            description: 'Minimum-necessary decision recorded for every share / access; data minimisation enforced.',
            reference: 'Caldicott Principle 3',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'caldicott-need-to-know',
            description: 'Strict need-to-know access gate active; role binding to NHS smartcard / role profile.',
            reference: 'Caldicott Principle 4',
            check: 'rbac_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'caldicott-guardian-designated',
            description: 'Caldicott Guardian named-role designation recorded; UKCGC registration current; sign-off path wired into approval-queue.',
            reference: 'Caldicott Guardian Manual; UKCGC',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'caldicott-guardian-signoff-on-non-routine',
            description: 'Caldicott Guardian sign-off captured on non-routine sharing, cross-trust transfers, and duty-to-share decisions.',
            reference: 'Caldicott Principles 6 + 7; Caldicott Guardian Manual',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'caldicott-duty-to-share',
            description: 'Principle 7 duty-to-share decisions captured as first-class; refusal-to-share decisions also justified.',
            reference: 'Caldicott Principle 7 (2020 revision)',
            check: 'governance_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'caldicott-patient-transparency',
            description: 'NHS Privacy Notice published; National Data Opt-Out honoured for non-direct-care use (research, planning).',
            reference: 'Caldicott Principle 8; National Data Opt-Out policy 2018',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'caldicott-annual-training',
            description: 'Annual Caldicott / data-security training attestation recorded for all staff with patient-data access.',
            reference: 'Caldicott Principle 5; NDG Data Security Standard #3',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'caldicott-audit-trail',
            description: 'Tamper-evident audit trail covers purpose justifications, Caldicott Guardian sign-off events, need-to-know access decisions, and patient-transparency artefact versions.',
            reference: 'Caldicott Principle 5; UK GDPR Art. 5(2)',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'caldicott-supplier-flow-down',
            description: 'Sub-supplier Caldicott posture recorded; data processor contracts include Caldicott obligations.',
            reference: 'Caldicott Principle 6; UK GDPR Art. 28',
            check: 'subservice_registry_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'caldicott-encryption',
            description: 'Patient confidential information encrypted at rest and in transit; consistent with NHS DSPT Section 7 and UK GDPR Art. 32.',
            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=caldicott-principles.js.map