"use strict";
/**
 * VIC Health Records Act 2001 (HRA)
 *
 * Single-jurisdiction pack for Victoria's Health Records Act 2001. Disaggregated
 * from the former au-state-health-privacy umbrella pack (X1-disaggregation, 2026-04-24).
 *
 * Administered by:
 *   - Health Complaints Commissioner (HCC): complaints, investigations, enforcement
 *     for health service providers in VIC.
 *   - Office of the Victorian Information Commissioner (OVIC): oversight of VIC
 *     public sector information privacy (separate from HCC's health-specific role).
 *
 * Scope: Private health service providers in Victoria. Public sector health agencies
 * are covered under the VIC Privacy and Data Protection Act 2014 (PDPA) with
 * distinct enforcement, but VIC HRA HPPs map to the same obligations.
 *
 * 11 Health Privacy Principles (HPPs):
 *   HPP 1  Collection
 *   HPP 2  Use and disclosure (HPP 2.2: research secondary use requires ethics
 *          committee approval or de-identification -- distinct from federal APP 6)
 *   HPP 3  Data quality
 *   HPP 4  Data security
 *   HPP 5  Openness
 *   HPP 6  Access
 *   HPP 7  Correction
 *   HPP 8  Identifiers
 *   HPP 9  Anonymity
 *   HPP 10 Transnational data flows
 *   HPP 11 Sensitive health information
 *
 * Retention (PROV guidance -- CITATION TO VERIFY current standards):
 *   - Public hospitals: 7 years from last service entry.
 *   - Mental health records: 25 years from creation [CITATION TO VERIFY].
 *   - Minor patients: 10 years from age 18 (or 7 years from last service, whichever later).
 *
 * Civil penalties: AUD 10,000 per body corporate (VCAT civil penalty orders).
 *
 * [CITATION TO VERIFY]:
 *   - VIC PROV current general health retention standards (7y from last service).
 *   - VIC mental health 25-year retention -- current PROV standards.
 *   - Whether NHMRC ethics approval satisfies VIC HPP 2.2 research provision for
 *     cross-jurisdictional AI training cohorts alongside NSW HPP 14.
 *
 * Cross-pack interactions:
 *   - au-vic-hra + au-privacy-act: VIC HRA overlays federal APPs. Federal NDB scheme
 *     applies to all APP entities regardless of state act. Strictest-wins.
 *   - au-vic-hra + au-nsw-hripa + au-act-hrpaa: Cross-state hospital networks must
 *     satisfy all applicable jurisdiction packs. 25-year VIC mental health retention
 *     is the strictest retention rule across the three jurisdictions.
 *   - au-vic-hra + hipaa (cross-border): VIC hospital sending research data to US
 *     partner -- VIC HRA governs AU-side; HIPAA de-identification safe harbor governs
 *     US-side. VIC HPP 2.2 must be satisfied independently of HIPAA requirements.
 *   - au-vic-hra + au-tga-saimd: TGA 10-year documentation retention overlaps VIC
 *     general health retention (7y adult) and VIC mental health (25y). Safe approach:
 *     10y from last service for general SaMD-associated VIC patient data; 25y for
 *     mental health records.
 *
 * Authority: HCC (Health Complaints Commissioner) + OVIC
 * Sovereignty: VIC State
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AU_VIC_HRA_PACK = exports.AU_VIC_HRA_CATEGORY_CLASSIFIERS = void 0;
exports.AU_VIC_HRA_CATEGORY_CLASSIFIERS = {
    VIC_HEALTH_INFORMATION: {
        references: ['VIC HRA 2001 HPP 1 -- health information in Victoria; HCC + OVIC administered'],
        classifier: (input) => {
            if (/\b(?:vic(?:toria(?:n)?)?\s+(?:health\s+(?:information|record|data)|hra\b|health\s+records\s+act)|health\s+information.*(?:vic(?:toria)?|victoria)|(?:health\s+service|hospital).*vic.*(?:health\s+record|patient\s+data))/i.test(input))
                return true;
            // HCC-specific references
            if (/\b(?:health\s+complaints\s+commissioner|hcc\s+vic|ovic|vic(?:torian)?\s+information\s+commissioner)\b/i.test(input))
                return true;
            return false;
        },
    },
    VIC_HEALTH_RESEARCH_USE: {
        references: ['VIC HRA HPP 2.2 -- research provision; ethics committee approval or de-identification required'],
        classifier: (input) => {
            if (/\b(?:(?:ai\s+training|research|secondary\s+analysis).*vic(?:toria)?\s+(?:health|patient)\s+(?:data|record)|vic(?:toria)?\s+health.*(?:ai\s+training|research\s+use)|ethics.*vic\s+health.*(?:research|training)|vic.*hpp\s*2\.2)\b/i.test(input))
                return true;
            return false;
        },
    },
    VIC_MENTAL_HEALTH_RECORD: {
        references: ['VIC HRA retention -- mental health records 25 years [CITATION TO VERIFY current PROV standards]'],
        classifier: (input) => {
            if (/\b(?:mental\s+health\s+(?:record|information|data).*(?:vic(?:toria)?|victoria)|vic.*mental\s+health\s+(?:record|retention|25\s+year))\b/i.test(input))
                return true;
            return false;
        },
    },
    VIC_HEALTH_MINOR_RECORD: {
        references: ['VIC HRA retention -- minor patient records 10 years from age 18 [CITATION TO VERIFY PROV guidance]'],
        classifier: (input) => {
            // F-NEW-VERA-PACK-C7-07 (LOW): broadened minor-record classifier.
            // Original regex required compound phrases like "minor vic health record"
            // or "vic health paediatric record". Real clinical inputs rarely combine
            // all three tokens in a single sentence. Broadened to fire on any VIC
            // health context that includes any of: minor, paediatric, pediatric,
            // child patient, under-18 framing (consistent with the finding requirement
            // that paediatric|pediatric|child.*patient|under.*18 should fire).
            if (/\b(?:minor.*vic.*health\s+record|vic.*health.*(?:paediatric|pediatric|child).*record|minor.*health.*(?:10\s+year|age\s+18).*vic)\b/i.test(input))
                return true;
            // Broadened patterns (C7-07):
            if (/\b(?:paediatric|pediatric)\b.*\b(?:vic|victoria)\b/i.test(input))
                return true;
            if (/\b(?:vic|victoria)\b.*\b(?:paediatric|pediatric)\b/i.test(input))
                return true;
            if (/\bchild.*patient\b.*\b(?:vic|victoria|hcc|ovic|hra)\b/i.test(input))
                return true;
            if (/\b(?:vic|victoria|hcc|ovic|hra)\b.*\bchild.*patient\b/i.test(input))
                return true;
            if (/\bunder[\s-]*18\b.*\b(?:vic|victoria|hcc|ovic)\b/i.test(input))
                return true;
            if (/\b(?:vic|victoria|hcc|ovic)\b.*\bunder[\s-]*18\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.AU_VIC_HRA_PACK = {
    categoryClassifiers: exports.AU_VIC_HRA_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: VIC health information is subject-keyed by patient identifier.
     * HPP 2.2 research provision enforcement, HPP 6/7 access/correction SLAs, and
     * retention tracking (including 25-year mental health) all require per-patient
     * identity correlation across VIC health service providers.
     */
    subjectKeyedCategories: [
        'VIC_HEALTH_INFORMATION',
        'VIC_HEALTH_RESEARCH_USE',
        'VIC_MENTAL_HEALTH_RECORD',
        'VIC_HEALTH_MINOR_RECORD',
    ],
    id: 'au-vic-hra',
    name: 'VIC Health Records Act 2001 (HRA)',
    version: '1.0.0',
    description: 'VIC HRA 2001 compliance for AI systems processing health information in Victoria. ' +
        'Enforces HPP 2.2 research secondary-use ethics gate (ethics committee approval or ' +
        'de-identification required), 25-year mental health record retention [CITATION TO VERIFY], ' +
        '30-day access/correction SLA (HPP 6/7), and HCC + OVIC dual-enforcer model. ' +
        'Civil penalty: AUD 10,000 per body corporate (VCAT). ' +
        '[CITATION TO VERIFY: PROV current general health retention (7y); VIC mental health 25y; ' +
        'NHMRC ethics cross-jurisdictional sufficiency for VIC HPP 2.2.]',
    authority: 'HCC (Health Complaints Commissioner) + OVIC (Office of the Victorian Information Commissioner)',
    industries: [
        'healthcare', 'hospitals', 'digital-health',
        'allied-health', 'medical-research', 'aged-care',
        'mental-health', 'health-it',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'HPP 2.2 research ethics approval gate; 30-day access/correction SLA enforcement',
            reference: 'VIC HRA HPP 2.2, HPP 6, HPP 7',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '7-year general (adult) / 10-year-from-18 (minor) / 25-year (mental health) retention; tamper-evident audit trail',
            reference: 'VIC PROV guidance [CITATION TO VERIFY]',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'HPP 4 data security; sensitive health info; AES-256 required',
            reference: 'VIC HRA HPP 4; Privacy Act APP 11',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify VIC health information; detect research use, mental health records, minor records',
            reference: 'VIC HRA HPP 1, HPP 2.2',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Research ethics confirmation gate (HPP 2.2); access/correction request workflow',
            reference: 'VIC HRA HPP 2.2, HPP 6, HPP 7',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-patient rights tracking; access/correction SLA 30 days; 25-year mental health retention schedule',
            reference: 'VIC HRA HPP 6, HPP 7; PROV guidance',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Research ethics event; breach notification (NDB + HCC/OVIC)',
            reference: 'VIC HRA; Privacy Act NDB',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'HPP 1.3 collection notice requirement; HPP 2.3 use/disclosure notification; inform individuals of AI use in health decisions',
            reference: 'VIC HRA HPP 1.3 (collection notice); HPP 2.3 (notification of use/disclosure)',
        },
        {
            name: 'supply-chain',
            required: true,
            // F-NEW-VERA-PACK-C7-08 (2026-05-03): supply-chain was present in au-nsw-hripa but
            // missing here. VIC health information processed by AI vendors requires vendor
            // contracts mandating AU (Victorian) server location and VAGO/privacy-impact-assessment
            // compliance. au-nsw-hripa already had this module; parity required.
            reason: 'VIC health information vendors must be contractually bound to AU data residency; VIC Privacy Commissioner audit rights; HPP 4 security obligations extend to processors and sub-processors',
            reference: 'VIC HRA HPP 4 (security obligations on processors); Privacy Act APP 8 (cross-border disclosure); AU data residency requirement for health information',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'VIC_HEALTH_INFORMATION',
                'VIC_HEALTH_RESEARCH_USE',
                'VIC_MENTAL_HEALTH_RECORD',
                'VIC_HEALTH_MINOR_RECORD',
            ],
            vicResearchEthicsApprovalRequired: true,
            healthRecordAccessSlaDays: 30,
            healthCollectionNoticeActive: true,
            healthCorrectionSlaDays: 30,
            vicMentalHealthRetentionYears: 25,
            vicMinorRetentionFromAge18Years: 10,
        },
        'governance-runtime': {
            vicResearchEthicsApprovalRequired: true,
            auStateHealthAccessResponseDays: 30,
            healthCollectionNoticeActive: true,
            auStateHealthCorrectionResponseDays: 30,
        },
        'session-persistence': {
            accessRequestSlaDays: 30,
            correctionRequestSlaDays: 30,
            auStateHealthMentalHealthRetentionDays: 9125, // 25 years
            auStateHealthMinorRetentionDays: 3650, // 10 years from age 18 (conservative)
        },
        'approval-queue': {
            vicResearchEthicsConfirmationRequired: true,
        },
        'transparency-injector': {
            auStateHealthCollectionNoticeEnabled: true,
        },
        'supply-chain': {
            vendorServerLocationRequired: true,
            auStateHealthVendorContractRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'ETHICS-APPROVAL-FOR-RESEARCH',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'VIC_HEALTH_INFORMATION',
            'VIC_HEALTH_RESEARCH_USE',
            'VIC_MENTAL_HEALTH_RECORD',
            'VIC_HEALTH_MINOR_RECORD',
        ],
        categoryActions: {
            VIC_HEALTH_INFORMATION: 'REQUIRE_APPROVAL',
            VIC_HEALTH_RESEARCH_USE: 'REQUIRE_APPROVAL',
            // F-NEW-VERA-PACK-C7-06 fix: VIC_MENTAL_HEALTH_RECORD action raised from WARN to
            // REQUIRE_APPROVAL. Mental health records under VIC Health Records Act 2001 carry
            // a 25-year retention obligation (the strictest in the AU state health pack catalog).
            // WARN is inadequate for a record class with a 25-year retention window and dual
            // regulatory oversight (HCC + OVIC + OAIC). REQUIRE_APPROVAL requires human review
            // before any processing, matching the sensitivity level of this record class.
            VIC_MENTAL_HEALTH_RECORD: 'REQUIRE_APPROVAL',
            VIC_HEALTH_MINOR_RECORD: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU-VIC'],
        // Conservative cross-class floor: 10 years from last service.
        // VIC mental health: 25 years [CITATION TO VERIFY current PROV standards].
        // TGA SaMD overlap: 10y governs general SaMD-associated VIC patient data.
        auditLogRetentionDays: 3650, // 10 years (conservative floor)
        sessionRetentionDays: 3650,
        // F-NEW-VERA-PACK-C7-06 fix: incidentRetentionDays raised from 1825 (5y, NDB-aligned)
        // to 2555 (7y) as the minimum floor for general health records.
        // Note: VIC mental health records have a 25-year retention obligation per PROV.
        // 7y is the floor for incident records tied to general health records;
        // mental health incident records effectively tie to the 25y window via the
        // underlying record retention. 2555 = 7 * 365.
        incidentRetentionDays: 2555, // 7 years (VIC Health Records Act 2001 minimum floor)
        reference: 'VIC PROV: 7y adult [CTV] / 25y mental health [CTV] / 10y-from-18 minor. TGA overlap: 10y governs SaMD records. Conservative floor: 10y from last service. Incident records: 7y minimum (25y for mental health incidents per underlying record retention).',
    },
    incidentPolicy: {
        notificationDeadlineHours: 720, // 30-day NDB baseline; HCC + OVIC also notified
        reference: 'Federal Privacy Act Part IIIC NDB (30d baseline); HCC for serious health privacy; OVIC for information privacy',
        requiredRecipients: ['vic-hcc', 'ovic', 'oaic'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-vic-hra-research-ethics',
            description: 'AI training or secondary analysis on VIC health data requires ethics committee approval or de-identification (HPP 2.2)',
            reference: 'VIC HRA HPP 2.2',
            check: 'au_vic_hra_research_ethics_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-vic-hra-mental-health-retention',
            description: 'VIC mental health records retained for 25 years [CITATION TO VERIFY current PROV standards]',
            reference: 'VIC PROV guidance [CITATION TO VERIFY]',
            check: 'au_vic_hra_mental_health_retention_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-vic-hra-access-30d',
            description: 'VIC health record access requests actioned within 30 days (HPP 6)',
            reference: 'VIC HRA HPP 6',
            check: 'au_vic_hra_access_30d_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-vic-hra-collection-notice',
            description: 'Collection notice presented before or at collection of VIC health information (HPP 1)',
            reference: 'VIC HRA HPP 1',
            check: 'au_vic_hra_collection_notice_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-vic-hra-correction-30d',
            description: 'VIC health information correction requests actioned within 30 days (HPP 7)',
            reference: 'VIC HRA HPP 7',
            check: 'au_vic_hra_correction_30d_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'au-vic-hra-minor-retention',
            description: 'VIC minor patient health records retained minimum 10 years from age 18',
            reference: 'VIC PROV guidance [CITATION TO VERIFY]',
            check: 'au_vic_hra_minor_retention_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-vic-hra.js.map