"use strict";
/**
 * CMS Interoperability and Patient Access Compliance Pack
 *
 * Regulation: CMS Interoperability and Patient Access Final Rule
 *             CMS-9115-F (85 FR 25510, May 1, 2020)
 *             45 CFR Part 170 (ONC Health IT Certification);
 *             42 CFR Parts 422 (MA), 431 (Medicaid), 438 (Medicaid MCO),
 *             457 (CHIP), 156 (FFE QHP Issuers)
 *
 * Jurisdiction: US (United States -- Federal)
 * Regulators: CMS (Centers for Medicare & Medicaid Services) +
 *             ONC (Office of the National Coordinator for Health IT)
 *
 * Alias: HC-06
 *
 * Key effective dates:
 *   - 1 July 2021: Patient Access API mandate (FHIR R4)
 *   - 1 January 2022: Provider Directory API
 *   - 1 January 2023: Payer-to-Payer Data Exchange (exchange on request)
 *   - 2026+: Prior Authorization API (CMS-0057-F, Advancing Interoperability
 *     and Improving Prior Authorization Processes Final Rule, 2024)
 *
 * Scope:
 *   Applies to: MA plans (Part C), Medicaid FFS, Medicaid MCOs, CHIP,
 *   Qualified Health Plan (QHP) issuers on FFEs. Requires covered payers
 *   to implement FHIR R4-based APIs for patient access, provider directories,
 *   payer-to-payer data exchange, and (under CMS-0057-F) prior authorization.
 *
 * Distinction from HIPAA:
 *   HIPAA restricts unauthorized disclosure of PHI. CMS Interoperability
 *   REQUIRES payers to MAKE data accessible to patients (and other payers)
 *   via standardized APIs. An AI system that blocks legitimate FHIR API
 *   responses violates CMS Interoperability; an AI system that discloses PHI
 *   without authorization violates HIPAA. Both packs may be active
 *   simultaneously; CMS Interoperability takes precedence for FHIR
 *   patient-access requests.
 *
 * Information Blocking:
 *   ONC 21st Century Cures Act information blocking rules (45 CFR Part 171)
 *   prohibit practices that unreasonably interfere with access, exchange,
 *   or use of electronic health information (EHI). AI systems MUST NOT
 *   block FHIR API access for legitimate patient requests. Only the eight
 *   enumerated exceptions apply (preventing harm, privacy, security,
 *   infeasibility, health IT performance, content and manner, fees,
 *   licensing exceptions).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.CMS_INTEROPERABILITY_PACK = exports.CMS_INTEROPERABILITY_CATEGORY_CLASSIFIERS = void 0;
exports.CMS_INTEROPERABILITY_CATEGORY_CLASSIFIERS = {
    PATIENT_CLINICAL_DATA_FHIR: {
        references: ['45 CFR §170.315(g)(10) -- FHIR R4 Patient Access API; US Core Implementation Guide'],
        classifier: (input) => {
            if (/\b(?:fhir\s+r4|fhir\s+resource|patient\s+access\s+api|us\s+core|smart\s+on\s+fhir|uscdi)\b/i.test(input))
                return true;
            if (/\b(?:patient\s+clinical\s+record|clinical\s+data\s+fhir|fhir\s+bundle|fhir\s+observation|fhir\s+condition|fhir\s+medication)\b/i.test(input))
                return true;
            if (/\b(?:claim\s+response\s+fhir|explanation\s+of\s+benefits\s+fhir|eob\s+fhir|coverage\s+fhir)\b/i.test(input))
                return true;
            return false;
        },
    },
    PATIENT_CLAIMS_DATA: {
        references: ['42 CFR §422.119(b)(1) -- claims and encounter data; CMS-9115-F Patient Access API scope'],
        classifier: (input) => {
            if (/\b(?:claims\s+data|encounter\s+data|adjudicated\s+claims|explanation\s+of\s+benefits|eob\s+data|remittance\s+advice)\b/i.test(input))
                return true;
            if (/\b(?:medicare\s+claims|medicaid\s+claims|chip\s+claims|prior\s+authorization\s+record|pa\s+record)\b/i.test(input))
                return true;
            return false;
        },
    },
    PAYER_TO_PAYER_DATA_EXCHANGE: {
        references: ['42 CFR §422.119(e) -- payer-to-payer data exchange; CMS-0057-F 2024 payer-to-payer'],
        classifier: (input) => {
            if (/\b(?:payer.to.payer|p2p\s+data|payer\s+exchange|payer\s+api\s+exchange|member\s+switching\s+payer)\b/i.test(input))
                return true;
            if (/\b(?:attribution\s+list|enrollee\s+data\s+exchange|concurrent\s+enrollment\s+data)\b/i.test(input))
                return true;
            if (/\b(?:cms.0057|advancing\s+interoperability|prior\s+auth\s+exchange)\b/i.test(input))
                return true;
            return false;
        },
    },
    PROVIDER_DIRECTORY_DATA: {
        references: ['42 CFR §422.120 -- provider directory API; CMS-9115-F Provider Directory'],
        classifier: (input) => {
            if (/\b(?:provider\s+directory|npi\s+directory|practitioner\s+directory|provider\s+api|provider\s+network\s+data)\b/i.test(input))
                return true;
            if (/\b(?:pdex\s+plan\s+net|provider\s+network\s+fhir|organization\s+fhir|location\s+fhir\s+provider)\b/i.test(input))
                return true;
            return false;
        },
    },
    PRIOR_AUTHORIZATION_DATA: {
        references: ['42 CFR §422.122 -- prior authorization API; CMS-0057-F 2024 prior authorization transparency'],
        classifier: (input) => {
            if (/\b(?:prior\s+authorization|pa\s+decision|pa\s+request|prior\s+auth\s+api|prior\s+authorization\s+fhir)\b/i.test(input))
                return true;
            if (/\b(?:medical\s+necessity\s+determination|pa\s+denial|pa\s+approval|gold\s+carding|step\s+therapy\s+pa)\b/i.test(input))
                return true;
            if (/\b(?:cms.0057|pa\s+transparency|prior\s+auth\s+reason\s+code)\b/i.test(input))
                return true;
            return false;
        },
    },
    PII: {
        references: ['HIPAA §164.514 -- PHI; 45 CFR §170.215 -- FHIR API security; CMS-9115-F security requirements'],
        classifier: (input) => {
            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
                return true;
            if (/\b\d{3}-\d{2}-\d{4}\b/.test(input))
                return true;
            if (/\b(?:medicare\s+id|beneficiary\s+id|medicaid\s+id|member\s+id|hicn|mbi)\b/i.test(input))
                return true;
            if (/\b(?:patient\s+name|patient\s+dob|date\s+of\s+birth\s+patient)\b/i.test(input))
                return true;
            return false;
        },
    },
    CREDENTIALS: {
        references: ['45 CFR §170.215 -- FHIR API authentication; SMART on FHIR authorization; OAuth 2.0 PKCE'],
        classifier: (input) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
                return true;
            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
                return true;
            if (/\b(?:client_secret|bearer\s+token|oauth\s+token|access_token)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+.]{16,}["']?/i.test(input))
                return true;
            return false;
        },
    },
};
exports.CMS_INTEROPERABILITY_PACK = {
    categoryClassifiers: exports.CMS_INTEROPERABILITY_CATEGORY_CLASSIFIERS,
    id: 'cms-interoperability',
    aliases: ['HC-06'],
    name: 'CMS Interoperability and Patient Access (CMS-9115-F)',
    version: '1.0.0',
    description: 'CMS Interoperability and Patient Access Final Rule (CMS-9115-F, 85 FR 25510) -- requires Medicare Advantage, Medicaid, CHIP, and FFE QHP payer plans to implement FHIR R4 APIs for patient clinical and claims data access, payer-to-payer data exchange (90-day window), provider directory APIs, and prior authorization APIs (CMS-0057-F, effective 2026). Enforces ONC information blocking prohibition: AI systems MUST NOT block legitimate FHIR patient access requests. Distinct from HIPAA: CMS Interoperability REQUIRES data accessibility; HIPAA restricts unauthorized disclosure. Both may be simultaneously active; CMS Interoperability governs affirmative access obligations.',
    authority: 'CMS (Centers for Medicare & Medicaid Services) + ONC (Office of the National Coordinator for Health IT)',
    industries: ['healthcare', 'health-insurance', 'managed-care', 'medicare-advantage', 'medicaid', 'chip', 'health-it'],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Enforce FHIR Patient Access API availability requirement; block AI actions that would constitute information blocking under 21st Century Cures Act 45 CFR Part 171; ensure prior authorization API responses comply with CMS-0057-F timelines',
            reference: '42 CFR §422.119 -- Patient Access API requirement; 45 CFR Part 171 -- information blocking prohibition; CMS-0057-F §422.122 -- prior authorization API compliance',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify patient clinical FHIR data, claims data, payer-to-payer exchange data, provider directory data, and prior authorization data for appropriate access and handling',
            reference: '45 CFR §170.315(g)(10) -- FHIR R4 data categories; 42 CFR §422.119(b)(1) -- claims data scope; USCDI -- US Core Data for Interoperability data classes',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'Tamper-evident log of FHIR API access events, payer-to-payer exchange events, prior authorization decisions, and information blocking incidents; required for ONC and CMS audit response',
            reference: '45 CFR §170.210 -- audit log requirements for health IT; HIPAA Security Rule 45 CFR §164.312(b) -- audit controls; ONC information blocking investigation requirements',
        },
        {
            name: 'agent-auth',
            required: true,
            reason: 'SMART on FHIR OAuth 2.0 PKCE authentication for Patient Access API; access control for payer-to-payer data exchange; provider directory API access management',
            reference: '45 CFR §170.215(b) -- SMART on FHIR authorization; 45 CFR §170.315(g)(10) -- API authentication requirement; ONC HTI-1 SMART 2.0 requirements',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'Patient PHI encrypted in transit (TLS 1.2+) and at rest per HIPAA Security Rule, which runs in parallel with CMS Interoperability requirements; FHIR API endpoints secured with TLS',
            reference: 'HIPAA Security Rule 45 CFR §164.312(a)(2)(iv) -- encryption and decryption; 45 CFR §170.210(h) -- encrypted audit log; CMS-9115-F security requirements',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Human review gate for AI-generated prior authorization decisions per CMS-0057-F; payer-to-payer exchange authorization workflow; information blocking exception determination review',
            reference: 'CMS-0057-F §422.122 -- prior authorization API and human review; 45 CFR Part 171 -- information blocking exception evaluation requires human determination',
        },
        {
            name: 'attestation-manager',
            required: true,
            reason: 'FHIR R4 API conformance attestation to CMS/ONC; US Core Implementation Guide conformance documentation; information blocking attestation under 21st Century Cures Act; annual API availability attestation',
            reference: '45 CFR §170.315(g)(10) -- FHIR certification; ONC Health IT Certification Program -- US Core conformance; 21st Century Cures Act §4004 -- information blocking attestation',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'API outage event notification to CMS; payer-to-payer data exchange failure tracking with 30-day cure period; prior authorization decision timeline clock management (CMS-0057-F)',
            reference: 'CMS-9115-F -- API availability requirements; 42 CFR §422.119(e) -- payer-to-payer exchange failure notification; CMS-0057-F -- prior authorization response timelines',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'Third-party health IT vendor FHIR conformance verification; SMART app (third-party application) registration and security review; information blocking supply chain accountability',
            reference: '45 CFR §170.315(g)(10) -- third-party application API; ONC app registration requirements; 21st Century Cures Act information blocking -- developer obligations',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'FHIR API session state management for 90-day payer-to-payer data exchange window; prior authorization status continuity; patient access token persistence within SMART scope',
            reference: '42 CFR §422.119(e) -- 90-day payer-to-payer exchange window; SMART on FHIR session management; CMS-0057-F prior authorization status continuity',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'Patient notification of data access rights under FHIR API; prior authorization denial reason transparency (CMS-0057-F specific reason codes); information blocking exception disclosure',
            reference: 'CMS-0057-F §422.122 -- PA denial reason transparency; 45 CFR Part 171 -- information blocking exceptions require transparent documentation; Patient Access API notice requirements',
        },
    ],
    moduleConfig: {
        'governance-runtime': {
            fhirR4ApiAvailabilityRequired: true,
            informationBlockingProhibitionEnforced: true,
            priorAuthorizationApiRequired: true,
            patientAccessApiBlockProhibited: true,
        },
        'data-classifier': {
            enabledCategories: ['PATIENT_CLINICAL_DATA_FHIR', 'PATIENT_CLAIMS_DATA', 'PAYER_TO_PAYER_DATA_EXCHANGE', 'PROVIDER_DIRECTORY_DATA', 'PRIOR_AUTHORIZATION_DATA', 'PII', 'CREDENTIALS'],
            patientClinicalDataAction: 'WARN',
            priorAuthorizationDataAction: 'WARN',
            credentialsAction: 'BLOCK',
        },
        'agent-auth': {
            smartOnFhirOAuth2PkceRequired: true,
            fhirApiAuthenticationRequired: true,
        },
        'approval-queue': {
            article22HumanReviewRequired: true,
            priorAuthorizationHumanReviewRequired: true,
            informationBlockingExceptionDeterminationRequired: true,
        },
        'attestation-manager': {
            fhirR4ConformanceAttestationRequired: true,
            usCoreImplementationGuideConformanceRequired: true,
            informationBlockingAttestationRequired: true,
        },
        'event-bus': {
            apiOutageNotificationRequired: true,
            payerToPayerExchangeFailureTrackingRequired: true,
            payerToPayerCurePeriodDays: 30,
        },
        'supply-chain': {
            thirdPartySmartAppRegistrationRequired: true,
            fhirConformanceVerificationRequired: true,
        },
        'session-persistence': {
            payerToPayerExchangeWindowDays: 90,
            priorAuthorizationStatusContinuityRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
        requiredCapabilities: ['HIPAA-BAA', 'FHIR-R4-CAPABLE', 'DATA-RESIDENCY-US', 'SOC2-TYPE-II'],
        blockReasons: {
            deepseek: 'PRC National Intelligence Law incompatible with HIPAA BAA requirements and PHI data sovereignty for Medicare/Medicaid beneficiary data under CMS Interoperability Rule.',
            baidu: 'PRC jurisdiction. Transfer of Medicare/Medicaid beneficiary PHI to PRC violates HIPAA 45 CFR §164.502 and CMS data residency expectations for CMS-9115-F compliance.',
            alibaba: 'PRC jurisdiction. Medicare/Medicaid beneficiary health data (FHIR bundles, claims, prior auth) must not transit PRC infrastructure due to HIPAA and CMS Interoperability sovereignty requirements.',
        },
    },
    dataPolicy: {
        scanCategories: ['PATIENT_CLINICAL_DATA_FHIR', 'PATIENT_CLAIMS_DATA', 'PAYER_TO_PAYER_DATA_EXCHANGE', 'PROVIDER_DIRECTORY_DATA', 'PRIOR_AUTHORIZATION_DATA', 'PII', 'CREDENTIALS'],
        categoryActions: {
            PATIENT_CLINICAL_DATA_FHIR: 'WARN',
            PATIENT_CLAIMS_DATA: 'WARN',
            PAYER_TO_PAYER_DATA_EXCHANGE: 'WARN',
            PROVIDER_DIRECTORY_DATA: 'WARN',
            PRIOR_AUTHORIZATION_DATA: 'WARN',
            PII: 'WARN',
            CREDENTIALS: 'BLOCK',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        // HIPAA general retention: 6 years from creation or last use.
        // CMS does not extend beyond HIPAA. FHIR API audit logs: HIPAA Security Rule minimum 6 years.
        auditLogRetentionDays: 2190, // 6 years (HIPAA Security Rule 45 CFR §164.316(b)(2)(i))
        sessionRetentionDays: 2190, // 6 years general PHI retention
        incidentRetentionDays: 2190, // 6 years for information blocking incidents and API audit logs
        reference: 'HIPAA 45 CFR §164.316(b)(2)(i) -- 6-year general retention; HIPAA Security Rule audit log retention; ONC information blocking investigation records; CMS-9115-F API availability audit requirements',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'], // PHI must remain in US jurisdiction
    },
    incidentPolicy: {
        // Information blocking complaint to ONC: reported immediately to OIG/ONC.
        // API outage: CMS notification expectation within operational SLA window.
        // Payer-to-payer exchange failure: 30-day cure period per CMS-0057-F.
        // Using 72 hours as the operational notification standard (aligns with HIPAA breach notification).
        notificationDeadlineHours: 72,
        reference: 'CMS-9115-F -- API outage notification requirements; 45 CFR Part 171 -- ONC information blocking complaint process; HIPAA 45 CFR §164.410 -- 60-day breach notification; CMS-0057-F -- prior authorization API outage response',
        requiredRecipients: ['cms-supervisory-contact', 'onc-information-blocking-complaint-desk', 'chief-compliance-officer', 'hipaa-privacy-officer'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'cms-interop-fhir-r4-api-availability',
            description: 'FHIR R4 Patient Access API availability enforced; AI systems prohibited from blocking legitimate patient access requests; US Core Implementation Guide conformance required',
            reference: '42 CFR §422.119 -- Patient Access API; 45 CFR §170.315(g)(10) -- FHIR R4 certification; ONC HTI-1 SMART 2.0',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cms-interop-information-blocking-prohibition',
            description: 'Information blocking prohibition active: AI must not block, filter, or delay FHIR API responses for legitimate patient requests; only 21st Century Cures Act exceptions permitted',
            reference: '21st Century Cures Act §3022; 45 CFR Part 171 -- information blocking prohibition; ONC information blocking enforcement',
            check: 'governance_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cms-interop-smart-fhir-auth',
            description: 'SMART on FHIR OAuth 2.0 PKCE authentication active for Patient Access API; third-party application authentication enforced',
            reference: '45 CFR §170.315(g)(10)(ii) -- SMART on FHIR authorization; ONC HTI-1 SMART 2.0 requirements; SMART App Launch v2.0',
            check: 'agent_auth_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cms-interop-data-classifier',
            description: 'Patient clinical FHIR data, claims data, payer-to-payer exchange data, and prior authorization data classified for appropriate access control',
            reference: '45 CFR §170.315(g)(10) -- FHIR data categories; USCDI -- data classes; 42 CFR §422.119 -- data scope',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cms-interop-audit-trail',
            description: 'Tamper-evident audit log of FHIR API access, payer-to-payer exchange events, and prior authorization decisions active',
            reference: '45 CFR §170.210 -- audit log requirements; HIPAA Security Rule 45 CFR §164.312(b) -- audit controls; ONC information blocking investigation',
            check: 'audit_trail_exists',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'cms-interop-payer-to-payer-exchange',
            description: 'Payer-to-payer data exchange event bus active; 90-day exchange window tracking; 30-day cure period for exchange failures',
            reference: '42 CFR §422.119(e) -- payer-to-payer data exchange; CMS-0057-F -- payer-to-payer exchange obligations',
            check: 'monitoring_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cms-interop-prior-auth-api',
            description: 'Prior authorization API human review gate active; PA denial reason transparency enforced per CMS-0057-F',
            reference: 'CMS-0057-F §422.122 -- prior authorization API; PA denial reason code transparency; PA response timeline requirements',
            check: 'approval_queue_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cms-interop-conformance-attestation',
            description: 'FHIR R4 conformance attestation maintained; US Core Implementation Guide conformance documented; information blocking attestation on file',
            reference: '45 CFR §170.315(g)(10) -- ONC certification; ONC Health IT Certification Program; 21st Century Cures Act §4004 -- information blocking attestation',
            check: 'attestation_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cms-interop-encryption',
            description: 'PHI in FHIR API payloads encrypted in transit (TLS 1.2+) and at rest; FHIR endpoint security enforced',
            reference: 'HIPAA Security Rule 45 CFR §164.312(a)(2)(iv); 45 CFR §170.210(h) -- encrypted audit log; CMS-9115-F security baseline',
            check: 'encryption_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cms-interop-access-control',
            description: 'Access to patient FHIR data, payer-to-payer exchange data, and prior authorization records limited to authorised personnel and authenticated applications',
            reference: 'HIPAA Security Rule 45 CFR §164.312(a)(1) -- access control; SMART on FHIR scopes; CMS-9115-F third-party app access management',
            check: 'rbac_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cms-interop-transparency',
            description: 'Patient notification of FHIR API data access rights active; prior authorization denial reason transparency injected into API responses',
            reference: 'CMS-0057-F -- PA denial reason codes; Patient Access API notice requirements; 45 CFR Part 171 -- information blocking exception disclosure',
            check: 'transparency_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'cms-interop-supply-chain',
            description: 'Third-party SMART app registration and security review active; FHIR vendor conformance verified; information blocking supply chain accountability enforced',
            reference: 'ONC third-party app registration requirements; 45 CFR §170.315(g)(10) -- developer obligations; 21st Century Cures Act -- developer information blocking duties',
            check: 'subservice_registry_active',
            failSeverity: 'HIGH',
        },
    ],
};
//# sourceMappingURL=cms-interoperability.js.map