"use strict";
/**
 * NHS Patient Safety Incident Response Framework (PSIRF) Compliance Pack
 *
 * Framework: NHS England Patient Safety Incident Response Framework
 *   v1.0 (August 2022) + supporting documents (PSIRP — Patient Safety
 *   Incident Response Plan; PSIRS — Patient Safety Incident Response
 *   Standards). Mandatory transition completed across NHS provider
 *   organisations in 2024 (replaces the prior Serious Incident
 *   Framework 2015).
 *
 * Jurisdiction: GB — NHS England-led; HSCNI (Northern Ireland) and
 *   NHS Scotland / NHS Wales operate parallel patient-safety incident
 *   regimes (sibling packs to follow).
 * Authority: NHS England (publisher) + Care Quality Commission (CQC,
 *   inspector) + Healthcare Safety Investigation Branch (HSIB / now HSSIB
 *   Health Services Safety Investigations Body, statutory under Health
 *   and Care Act 2022).
 *
 * Why this pack:
 *   - PSIRF is the operational patient-safety incident regime across the
 *     NHS — what every provider trust uses when something goes wrong
 *     with a patient. Distinct from DCB0129/0160 (product-level clinical
 *     safety case, covered by `nhs-clinical-safety` pack PR #400) which
 *     is the manufacturer/deployer side. PSIRF is the operational side.
 *   - DCB0129/0160 references PSIRF as the escalation pathway when a
 *     hazard reaches a patient. PSIRF is what the four prior NHS packs
 *     (DSPT, DTAC, Clinical Safety, Caldicott) don't cover — the
 *     incident-response operating model.
 *   - Pairs with `nhs-clinical-safety` (PR #400), `nhs-dspt` (PR #395),
 *     `caldicott-principles` (PR #406), `nhs-dtac` (PR #404).
 *
 * Four core PSIRF principles (PSIRP/PSIRS):
 *   1. Compassionate engagement and involvement of those affected by
 *      patient safety incidents
 *   2. Application of a range of system-based approaches to learning
 *      from patient safety incidents
 *   3. Considered and proportionate responses
 *   4. Supportive oversight focused on strengthening response system
 *      functioning and improvement
 *
 * Key operational requirements:
 *   - **PSIRP** (Patient Safety Incident Response Plan): each NHS provider
 *     organisation publishes a 12–18 month plan of incident-response
 *     priorities aligned with local risk profile. Reviewed at least
 *     annually.
 *   - **PSIRS** (Patient Safety Incident Response Standards): the
 *     baseline standards every PSIRF response must meet (engagement,
 *     learning response method, oversight, etc.).
 *   - **Engagement and involvement**: patients, families, and staff
 *     affected by an incident are engaged early and meaningfully.
 *   - **Learning Response Methods**: After Action Review (AAR), Multi-
 *     disciplinary Team (MDT) review, Swarm huddle, Case Note Review,
 *     Patient Safety Incident Investigation (PSII — replaces SIRI).
 *   - **Reporting**: incidents reported to the Learn from Patient Safety
 *     Events (LFPSE) service (replaced NRLS in 2023).
 *   - **HSSIB referrals**: certain serious incidents trigger statutory
 *     HSSIB engagement (Health and Care Act 2022).
 *   - **Duty of Candour**: statutory duty to be open and honest with
 *     patients/families when something goes wrong (CQC Reg 20).
 *
 * Out of scope:
 *   - DCB0129/0160 product-level clinical safety case (separate pack)
 *   - HSCNI / NHS Scotland / NHS Wales incident regimes (sibling packs)
 *   - General CQC well-led / safe / effective inspection (separate)
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NHS_PSIRF_PACK = exports.NHS_PSIRF_CATEGORY_CLASSIFIERS = void 0;
exports.NHS_PSIRF_CATEGORY_CLASSIFIERS = {
    PATIENT_SAFETY_INCIDENT: {
        references: [
            'NHS England PSIRF v1.0 (Aug 2022) — incident definition + LFPSE reporting',
        ],
        classifier: (input) => {
            if (/\b(?:patient[\s-]?safety[\s-]?incident|psi\s+report|psii|psirf\s+incident|psirs\s+incident)\b/i.test(input))
                return true;
            if (/\b(?:lfpse|learn\s+from\s+patient\s+safety\s+events)\b/i.test(input))
                return true;
            if (/\b(?:never\s+event|moderate\s+harm|severe\s+harm|catastrophic\s+harm|death\s+notifiable)\b/i.test(input))
                return true;
            return false;
        },
    },
    PSIRP_PLAN: {
        references: [
            'PSIRP Patient Safety Incident Response Plan — 12-18 month publication',
        ],
        classifier: (input) => {
            if (/\b(?:psirp|patient\s+safety\s+incident\s+response\s+plan|psirf\s+plan|psirf\s+priority\s+area)\b/i.test(input))
                return true;
            return false;
        },
    },
    LEARNING_RESPONSE: {
        references: [
            'PSIRF learning response methods: AAR, MDT, Swarm, Case Note Review, PSII',
        ],
        classifier: (input) => {
            if (/\b(?:after\s+action\s+review|aar\s+psirf|swarm\s+huddle|mdt\s+review\s+psirf)\b/i.test(input))
                return true;
            if (/\b(?:case\s+note\s+review\s+psirf|patient\s+safety\s+incident\s+investigation|psii\s+report)\b/i.test(input))
                return true;
            if (/\b(?:learning\s+response\s+method|learning\s+response\s+report|lessons\s+learned\s+psirf)\b/i.test(input))
                return true;
            return false;
        },
    },
    ENGAGEMENT_RECORD: {
        references: [
            'PSIRF compassionate engagement principle — patient + family + staff involvement',
        ],
        classifier: (input) => {
            if (/\b(?:patient\s+(?:engagement|involvement)\s+psirf|family\s+engagement\s+psirf|engagement\s+meeting\s+psirf)\b/i.test(input))
                return true;
            if (/\b(?:duty\s+of\s+candour|cqc\s+reg\s*20|reg\s*20\s+notification|candour\s+conversation)\b/i.test(input))
                return true;
            return false;
        },
    },
    HSSIB_REFERRAL: {
        references: [
            'Health and Care Act 2022 — Health Services Safety Investigations Body (HSSIB)',
        ],
        classifier: (input) => {
            if (/\b(?:hssib|hsib\s+investigation|health\s+services\s+safety\s+investigations\s+body)\b/i.test(input))
                return true;
            if (/\b(?:hssib\s+referral|safe\s+space\s+investigation|hssib\s+notice)\b/i.test(input))
                return true;
            return false;
        },
    },
    OVERSIGHT_REVIEW: {
        references: [
            'PSIRF supportive oversight — board-level review, ICB engagement, NHS England oversight',
        ],
        classifier: (input) => {
            if (/\b(?:psirf\s+(?:board|trust)\s+review|board\s+patient\s+safety\s+report|psirf\s+oversight)\b/i.test(input))
                return true;
            if (/\b(?:icb\s+psirf|integrated\s+care\s+board\s+(?:patient\s+safety|psirf))\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety; PSIRF artefacts must not embed credentials'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            return false;
        },
    },
};
exports.NHS_PSIRF_PACK = {
    categoryClassifiers: exports.NHS_PSIRF_CATEGORY_CLASSIFIERS,
    id: 'nhs-psirf',
    aliases: [
        'psirf',
        'psirp',
        'psirs',
        'nhs-patient-safety-incident-response-framework',
        'patient-safety-incident-response-framework',
        'nhs-incident-response',
    ],
    name: 'NHS Patient Safety Incident Response Framework (PSIRF)',
    version: '1.0.0',
    description: 'NHS England operational patient-safety incident regime (PSIRF v1.0 Aug 2022). Mandatory across NHS provider organisations as of the 2024 transition; replaced the Serious Incident Framework 2015. Covers compassionate engagement, system-based learning response methods (AAR, MDT, Swarm, Case Note Review, PSII), proportionate responses, and supportive oversight. Reporting via the LFPSE (Learn from Patient Safety Events) service. Statutory HSSIB referrals under Health and Care Act 2022. CQC Reg 20 Duty of Candour overlay. Distinct from DCB0129/0160 product-level clinical safety case (`nhs-clinical-safety` pack); PSIRF is the operational side that DCB0129/0160 references as the escalation pathway.',
    authority: 'NHS England (PSIRF publisher) + Care Quality Commission (CQC, inspector) + Health Services Safety Investigations Body (HSSIB) + Integrated Care Boards (ICBs)',
    industries: ['healthcare', 'pharma', 'public-sector', 'digital-health', 'medical-devices', 'clinical-research'],
    requiredModules: [
        {
            name: 'attestation-manager',
            required: true,
            reason: 'PSIRP (Patient Safety Incident Response Plan) registration, annual review, and 12-18 month priority-area attestation; PSIRS adherence; Duty of Candour (CQC Reg 20) attestation.',
            reference: 'PSIRF v1.0 §3 PSIRP; CQC Reg 20',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Default-deny on AI clinical actions affecting patient care without an active PSIRP-covered learning-response pathway; AI-incident escalation gate.',
            reference: 'PSIRF principle 3 considered and proportionate responses',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Patient-safety incident detection + LFPSE reporting routing; HSSIB referral pathway for serious incidents; Duty of Candour notification trigger; ICB / NHS England oversight reporting.',
            reference: 'PSIRF §4 reporting; LFPSE service; HSSIB statutory referrals',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Learning response method selection (AAR, MDT, Swarm, Case Note Review, PSII) approval; HSSIB referral decision approval; Duty of Candour conversation sign-off (T2 named-clinician review).',
            reference: 'PSIRF principles + CQC Reg 20',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident audit chain for incident records, learning-response reports, engagement records, oversight reviews, and HSSIB correspondence — required for CQC inspection evidence + PSIRF maturity assessment.',
            reference: 'PSIRF supportive oversight principle; CQC well-led KLOE',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'Patient + family + staff engagement records (compassionate engagement principle); engagement-meeting attendance + outcomes captured.',
            reference: 'PSIRF principle 1 compassionate engagement',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Surface PSIRF evidence categories (incident, PSIRP, learning response, engagement, HSSIB, oversight) for the audit chain and the dashboard.',
            reference: 'PSIRF evidence categorisation',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Incident records and learning-response reports retained alongside the underlying clinical record (8-year adult clinical default per nhs-dspt / Records Management Code of Practice 2021; per-record paediatric and maternity overrides).',
            reference: 'NHS Records Management Code of Practice 2021',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Patient-facing engagement letters; CQC Reg 20 Duty of Candour written notification; learning-response report public-facing summary where appropriate.',
            reference: 'CQC Reg 20 Duty of Candour; PSIRF engagement principle',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'Named-role binding for incident response: Patient Safety Specialist (PSS), Senior Responsible Officer, Family Liaison, HSSIB Liaison.',
            reference: 'PSIRF named roles',
        },
    ],
    moduleConfig: {
        'attestation-manager': {
            psirpRegistrationRequired: true,
            psirpAnnualReviewRequired: true,
            cqcReg20DutyOfCandourTracked: true,
            engagementRecordRequired: true,
        },
        'governance-runtime': {
            defaultDenyOnUncoveredClinicalAiPath: true,
            psirpPathwayGateRequired: true,
        },
        'event-bus': {
            lfpseReportingRequired: true,
            hssibReferralRoutingRequired: true,
            cqcReg20NotificationTriggerRequired: true,
            icbOversightRoutingRequired: true,
        },
        'approval-queue': {
            learningResponseMethodApprovalRequired: true,
            hssibReferralApprovalRequired: true,
            cqcReg20ConversationSignOffRequired: true,
            reviewTier: 'T2',
            reviewerCompetence: 'PATIENT_SAFETY_SPECIALIST',
        },
        'audit-integrity': {
            cqcEvidenceTrackingRequired: true,
            psirfMaturityEvidenceTrackingRequired: true,
        },
        'data-classifier': {
            enabledCategories: [
                'PATIENT_SAFETY_INCIDENT',
                'PSIRP_PLAN',
                'LEARNING_RESPONSE',
                'ENGAGEMENT_RECORD',
                'HSSIB_REFERRAL',
                'OVERSIGHT_REVIEW',
                'CREDENTIALS',
            ],
            credentialsAction: 'BLOCK',
        },
        'session-persistence': {
            retentionAlignmentWithUnderlyingClinicalRecord: true,
        },
        'transparency-injector': {
            cqcReg20WrittenNotificationRequired: true,
            patientFacingEngagementLetterRequired: true,
        },
        'agent-auth': {
            patientSafetySpecialistRoleBindingRequired: true,
            familyLiaisonRoleBindingRequired: true,
            hssibLiaisonRoleBindingRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['DATA-RESIDENCY-UK', 'PROCESSOR-CONTRACT', 'NHS-DSPT-SUBSCRIBED'],
        blockReasons: {
            deepseek: 'PRC jurisdiction. PSIRF incident records contain patient confidential information; UK data residency required.',
            baidu: 'PRC jurisdiction. NHS PSIRF evidence cannot route through PRC infrastructure.',
            alibaba: 'PRC jurisdiction. NHS PSIRF evidence cannot route through PRC infrastructure.',
        },
    },
    dataPolicy: {
        scanCategories: [
            'PATIENT_SAFETY_INCIDENT',
            'PSIRP_PLAN',
            'LEARNING_RESPONSE',
            'ENGAGEMENT_RECORD',
            'HSSIB_REFERRAL',
            'OVERSIGHT_REVIEW',
            'CREDENTIALS',
        ],
        categoryActions: {
            PATIENT_SAFETY_INCIDENT: 'WARN',
            PSIRP_PLAN: 'WARN',
            LEARNING_RESPONSE: 'WARN',
            ENGAGEMENT_RECORD: 'WARN',
            HSSIB_REFERRAL: 'WARN',
            OVERSIGHT_REVIEW: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 2920, // 8 years (alongside clinical record)
        sessionRetentionDays: 2920,
        incidentRetentionDays: 2920,
        reference: 'NHS Records Management Code of Practice 2021 (alongside clinical record); paediatric / maternity per-record overrides',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['gb'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 72,
        reference: 'PSIRF LFPSE reporting; CQC Reg 20 Duty of Candour as soon as reasonably practicable; HSSIB referral statutory pathway',
        requiredRecipients: [
            'patient-safety-specialist',
            'senior-responsible-officer',
            'family-liaison',
            'cqc-when-applicable',
            'hssib-when-applicable',
            'icb',
        ],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nhs-psirf-psirp-current',
            description: 'PSIRP registered, current within annual review window, and signed off by trust board.',
            reference: 'PSIRF v1.0 §3 PSIRP',
            check: 'attestation_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-psirf-incident-detection',
            description: 'Patient-safety incident detection wired; LFPSE reporting pathway active; AI-incident escalation route defined.',
            reference: 'PSIRF §4 reporting; LFPSE service',
            check: 'monitoring_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-psirf-learning-response',
            description: 'Learning response method (AAR, MDT, Swarm, Case Note Review, PSII) selected for each incident based on PSIRP priorities; outcome captured.',
            reference: 'PSIRF learning response methods',
            check: 'approval_queue_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-psirf-compassionate-engagement',
            description: 'Patient + family + staff engagement records captured; engagement meetings logged; outcomes summarised.',
            reference: 'PSIRF principle 1 compassionate engagement',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-psirf-duty-of-candour',
            description: 'CQC Reg 20 Duty of Candour conversation triggered for moderate or worse harm; written notification sent; sign-off captured.',
            reference: 'CQC Regulation 20 Duty of Candour',
            check: 'transparency_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nhs-psirf-hssib-referral',
            description: 'HSSIB referral pathway active for qualifying incidents; statutory safe-space evidence chain captured.',
            reference: 'Health and Care Act 2022 HSSIB',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-psirf-oversight',
            description: 'Board-level patient-safety oversight reports captured; ICB engagement and NHS England oversight evidenced.',
            reference: 'PSIRF principle 4 supportive oversight',
            check: 'audit_trail_exists',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-psirf-named-roles',
            description: 'Patient Safety Specialist + Senior Responsible Officer + Family Liaison + HSSIB Liaison named roles current.',
            reference: 'PSIRF named-role designations',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-psirf-evidence-retention',
            description: 'Incident records retained alongside clinical record (8-year adult clinical default); legal-hold support active for live investigations.',
            reference: 'NHS Records Management Code of Practice 2021',
            check: 'retention_policy_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'nhs-psirf-encryption',
            description: 'PSIRF evidence chain encrypted at rest and in transit per NHS DSPT Section 7.',
            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
            check: 'encryption_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=nhs-psirf.js.map