"use strict";
/**
 * HIPAA Breach Notification Report Template
 *
 * Satisfies 45 CFR 164.404 (Notification to Individuals), 164.406
 * (Notification to Media), and 164.408 (Notification to HHS Secretary).
 *
 * Regulatory references:
 *   45 CFR Part 164, Subpart D -- Notification in Case of Breach
 *   45 CFR 164.402 -- Definitions (breach, unsecured PHI)
 *   45 CFR 164.404 -- Notification to Individuals (60-day deadline)
 *   45 CFR 164.406 -- Notification to Media (>500 individuals affected)
 *   45 CFR 164.408 -- Annual log to HHS / immediate if >=500
 *   45 CFR 164.414 -- Administrative requirements and burden of proof
 *   HITECH Act Section 13402
 *
 * Required audit event types:
 *   security:incident:* -- any security incident (covers :major, :minor, etc.)
 *   retention:legal-hold-created -- legal preservation order on affected data
 *   approval:decided -- documented human review of the breach determination
 *
 * Spec: P4-AIR-02 item 2
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.HIPAA_BREACH_NOTIFICATION_TEMPLATE = void 0;
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is absent for a required
element, write "No evidence found in the audit window for this element (45 CFR
164.414 burden of proof applies -- covered entity must supplement this record
with contemporaneous documentation)." Never invent event IDs.
`.trim();
exports.HIPAA_BREACH_NOTIFICATION_TEMPLATE = {
    templateId: 'tpl-hipaa-breach-notification-v1',
    name: 'HIPAA Breach Notification Report (45 CFR 164.404)',
    framework: 'hipaa',
    requiredAuditEventTypes: [
        'security:incident:*',
        'retention:legal-hold-created',
        'approval:decided',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'hipaa-bn-breach-determination',
            title: '1. Breach Determination and Risk Assessment (45 CFR 164.402)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Breach Determination section for a HIPAA Breach Notification
report under 45 CFR 164.402 and 164.404.

A breach is presumed unless the covered entity demonstrates that there is a low
probability that PHI has been compromised, assessed under the four-factor risk
assessment (164.402(2)(ii)):
  (A) Nature and extent of PHI involved (identifiers + sensitivity)
  (B) Who used the PHI or to whom it was disclosed
  (C) Whether PHI was actually acquired or viewed
  (D) Extent to which risk has been mitigated

Using ONLY the audit-chain events provided, describe:
1. The triggering security incident(s) and the timestamp of discovery.
2. AI agent behaviour observed prior to and during the incident.
3. The four-factor risk assessment as supported by the audit chain evidence.
4. The breach determination outcome (breach confirmed / low probability
   exception applies) and who made the determination.
5. Cite the approval:decided event confirming the breach determination review.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs. This section must be legally defensible.
`.trim(),
        },
        {
            id: 'hipaa-bn-timeline',
            title: '2. Breach Timeline and Discovery (45 CFR 164.404(a))',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Breach Timeline section for a HIPAA Breach Notification
report under 45 CFR 164.404(a) (notification required without unreasonable delay
and within 60 calendar days of discovery).

Using ONLY the audit-chain events provided, describe:
1. Date and time of the breach (or suspected breach) as evidenced in the chain.
2. Date of discovery by the covered entity or business associate.
3. Elapsed time from breach to discovery (any delay must be explained).
4. Actions taken immediately upon discovery (legal hold, containment, escalation).
5. Whether the 60-day notification clock has started and, if so, the deadline.

${CITATION_INSTRUCTION}

Write 3-4 formal paragraphs. Include specific timestamps from the cited events.
`.trim(),
        },
        {
            id: 'hipaa-bn-scope',
            title: '3. Scope of Affected Individuals and PHI (45 CFR 164.404(c))',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Scope of Breach section for a HIPAA Breach Notification
report. Per 45 CFR 164.404(c), the notification to individuals must include:
  (1) Description of the breach
  (2) Types of information involved
  (3) Steps individuals should take to protect themselves
  (4) Steps the covered entity is taking to investigate, mitigate, and prevent recurrence

Using ONLY the audit-chain events provided, describe:
1. Categories of PHI involved (diagnoses, medications, financial, demographic, etc.)
   as evidenced by the data-classification or retention tags in the chain.
2. Estimated number of individuals affected (if determinable from chain evidence).
3. Whether 500 or more individuals in a single state are affected (triggers
   media notification under 164.406).
4. Whether 500 or more individuals are affected in total (triggers immediate
   HHS notification under 164.408(b)).

${CITATION_INSTRUCTION}

Write 3-5 paragraphs.
`.trim(),
        },
        {
            id: 'hipaa-bn-legal-hold',
            title: '4. Evidence Preservation and Legal Hold (45 CFR 164.414)',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Evidence Preservation section for a HIPAA Breach
Notification report under 45 CFR 164.414 (documentation and burden of proof).

Covered entities must retain documentation of notifications and determinations
for six years from creation or last effective date.

Using ONLY the audit-chain events provided, describe:
1. Legal hold(s) placed on affected data and systems (cite retention:legal-hold-created
   events with timestamps).
2. Scope of the hold: which data sets, systems, or agent activity logs are
   preserved under the hold.
3. Chain-of-custody controls: how the tamper-evident audit chain preserves
   integrity of breach evidence.
4. Six-year retention commitment: confirm that the chain entries and associated
   records are flagged for mandatory six-year retention.

${CITATION_INSTRUCTION}

Write 3-4 formal paragraphs.
`.trim(),
        },
        {
            id: 'hipaa-bn-remediation',
            title: '5. Containment, Remediation, and Prevention',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Remediation section for a HIPAA Breach Notification report.

Using ONLY the audit-chain events provided, describe:
1. Immediate containment actions taken (e.g., agent suspension, access revocation,
   circuit-breaker activation) citing specific enforcement events.
2. Root-cause analysis: what governance gap, policy violation, or external attack
   vector enabled the breach.
3. Corrective controls implemented or planned to prevent recurrence.
4. Approval or sign-off events confirming that remediation was reviewed by an
   authorised privacy/security officer.

${CITATION_INSTRUCTION}

Write 3-5 paragraphs.
`.trim(),
        },
        {
            id: 'hipaa-bn-hhs-notification',
            title: '6. HHS Notification Status (45 CFR 164.408)',
            citationRequirement: 'optional',
            promptTemplate: `
You are drafting the HHS Notification Status section for a HIPAA Breach
Notification report under 45 CFR 164.408.

Notification to HHS Secretary is required:
  - Immediately (within 60 days) if the breach affects 500 or more individuals
  - Annually (by 60 days after end of calendar year) for breaches affecting
    fewer than 500 individuals

Using the audit-chain events and scope data provided, describe:
1. Whether HHS notification has been submitted or is pending.
2. The submission deadline based on the breach scope.
3. If notification has been submitted: date, method, and confirmation reference.
4. If notification is pending: the planned submission date and responsible party.

If the audit chain does not contain HHS submission evidence, state that this
section must be completed with contemporaneous records held outside the AI
governance platform.
`.trim(),
        },
    ],
};
//# sourceMappingURL=hipaa-breach-notification.js.map