/**
 * NSW Health Records and Information Privacy Act 2002 (HRIPA)
 *
 * Single-jurisdiction pack for NSW HRIPA. Disaggregated from the former
 * au-state-health-privacy umbrella pack (X1-disaggregation, 2026-04-24).
 *
 * Administered by: Information and Privacy Commission NSW (IPC NSW).
 * Scope: NSW public sector agencies, public hospitals, private organisations
 * with annual turnover >AUD 3M conducting health service business in NSW,
 * and smaller entities holding health information.
 *
 * 15 Health Privacy Principles (HPPs):
 *   HPP 1  Collection
 *   HPP 2  Anonymity
 *   HPP 3  Collection solicited from third parties
 *   HPP 4  Unsolicited health information
 *   HPP 5  Notification
 *   HPP 6  Use and disclosure
 *   HPP 7  Identifiers
 *   HPP 8  Quality
 *   HPP 9  Data security
 *   HPP 10 Transborder data flows -- stricter than federal APP 8 for some
 *          intra-AU transfers; NSW health info must not transfer outside NSW
 *          unless: (a) recipient jurisdiction provides equivalent protections,
 *          (b) individual consented, (c) required by AU/NSW law, or (d) transfer
 *          in individual's best interests and consent cannot be obtained.
 *          [CITATION TO VERIFY: whether federal Privacy Act qualifies as
 *           "equivalent protection" under current IPC NSW guidance]
 *   HPP 11 Access
 *   HPP 12 Correction
 *   HPP 13 Unique identifiers
 *   HPP 14 Exemption -- research/law enforcement
 *   HPP 15 Exempt agencies
 *
 * Retention: State Records Act 1998 (NSW) + HRIPA Regulation 2017.
 *   - Public sector: minimum 7 years from last service entry.
 *   - Minors: 10 years from age 18 (or 7 years from last service, whichever later).
 *
 * Civil penalties: AUD 22,000 per body corporate per contravention.
 * Criminal liability for serious interference (s.68 HRIPA).
 *
 * [CITATION TO VERIFY]:
 *   - Whether federal Privacy Act 1988 provides "equivalent protection" for
 *     intra-AU transfers under HPP 10 per current IPC NSW position.
 *   - Whether NHMRC ethics approval satisfies NSW HPP 14 research exception
 *     for cross-jurisdictional AI training cohorts.
 *
 * Cross-pack interactions:
 *   - au-nsw-hripa + au-privacy-act: NSW HRIPA overlays federal APPs. Where NSW
 *     HPP is stricter (HPP 10 transborder), NSW HRIPA governs. Federal NDB scheme
 *     applies to all APP entities regardless of state act. Strictest-wins.
 *   - au-nsw-hripa + au-vic-hra + au-act-hrpaa: Cross-state hospital networks
 *     operating in all three jurisdictions must satisfy all three packs. HPP
 *     numbering differs across jurisdictions; pack IDs disambiguate.
 *   - au-nsw-hripa + hipaa (cross-border): AU hospital sending de-identified
 *     research data to US partner -- NSW HRIPA governs AU-side disclosure;
 *     HIPAA de-identification safe harbor governs US-side. HIPAA de-identification
 *     standard does NOT automatically satisfy NSW HRIPA standards.
 *   - au-nsw-hripa + au-tga-saimd: TGA 10-year technical documentation overlaps
 *     NSW retention (7y adult / 10y-from-18 minor). Safe approach: 10 years from
 *     last service for all SaMD-associated NSW patient data. Longer governs.
 *   - au-nsw-hripa + au-mandatory-ai-guardrails: Healthcare = proposed high-risk
 *     setting. NSW HPP 10 transborder controls and research ethics gate (HPP 14)
 *     add specificity within proposed mandatory privacy guardrail G9.
 *
 * Authority: IPC NSW (Information and Privacy Commission NSW)
 * Sovereignty: NSW State
 *
 * @connexum/ai-governance
 */
export const AU_NSW_HRIPA_CATEGORY_CLASSIFIERS = {
    NSW_HEALTH_INFORMATION: {
        references: ['NSW HRIPA 2002 HPP 1 -- health information in NSW; IPC NSW administered'],
        classifier: (input) => {
            if (/\b(?:nsw\s+(?:health\s+(?:information|record|data)|hripa|health\s+privacy)|health\s+information.*(?:nsw|new\s+south\s+wales)|(?:public\s+hospital|health\s+service).*nsw.*(?:health\s+record|patient\s+data))/i.test(input))
                return true;
            // IPC NSW-specific references
            if (/\b(?:ipc\s+nsw|information\s+and\s+privacy\s+commission\s+nsw|hripa\s+regulation\s+2017|state\s+records\s+act.*nsw)\b/i.test(input))
                return true;
            return false;
        },
    },
    NSW_HEALTH_TRANSBORDER_TRANSFER: {
        references: ['NSW HRIPA 2002 HPP 10 -- transborder data flows; consent or equivalent-protection required'],
        classifier: (input) => {
            if (/\bNSW\s+HRIPA\b/i.test(input))
                return true;
            if (/\bHPP\s*10\b/i.test(input))
                return true;
            if (/\btransborder\b.*\b(?:NSW|health\s+information)\b/i.test(input))
                return true;
            if (/\bNSW\b.*\bhealth\s+information\b.*\btransborder\b/i.test(input))
                return true;
            if (/\b(?:nsw\s+health.*(?:transfer|outside\s+nsw|offshore|cloud)|transfer.*nsw\s+health\s+information.*(?:overseas|vic|qld|outside)|nsw\s+hpp\s*10|transborder.*nsw\s+health)\b/i.test(input))
                return true;
            return false;
        },
    },
    NSW_HEALTH_RESEARCH_USE: {
        references: ['NSW HRIPA HPP 14 -- research exception; ethics approval or de-identification required'],
        classifier: (input) => {
            if (/\b(?:(?:ai\s+training|research|secondary\s+analysis).*nsw\s+(?:health|patient)\s+(?:data|record)|nsw\s+health.*(?:ai\s+training|research\s+use)|ethics.*nsw\s+health.*(?:research|training)|nsw.*hpp\s*1[14])\b/i.test(input))
                return true;
            return false;
        },
    },
    NSW_HEALTH_MINOR_RECORD: {
        references: ['NSW HRIPA Regulation 2017 -- minor patient retention 10 years from age 18'],
        classifier: (input) => {
            // F-NEW-VERA-PACK-C7-07 (LOW): broadened minor-record classifier.
            // Original regex required compound phrases like "minor nsw health record"
            // or "nsw health paediatric record". Real clinical inputs rarely combine
            // all three tokens in a single sentence. Broadened to fire on any NSW
            // health context that includes any of: minor, paediatric, pediatric,
            // child patient, under-18 framing (consistent with the finding requirement
            // that paediatric|pediatric|child.*patient|under.*18 should fire).
            if (/\b(?:minor.*nsw.*health\s+record|nsw.*health.*(?:paediatric|pediatric|child).*record|minor.*health.*(?:10\s+year|age\s+18).*nsw)\b/i.test(input))
                return true;
            // Broadened patterns (C7-07):
            if (/\b(?:paediatric|pediatric)\b.*\b(?:nsw|new\s+south\s+wales)\b/i.test(input))
                return true;
            if (/\b(?:nsw|new\s+south\s+wales)\b.*\b(?:paediatric|pediatric)\b/i.test(input))
                return true;
            if (/\bchild.*patient\b.*\b(?:nsw|new\s+south\s+wales|hripa)\b/i.test(input))
                return true;
            if (/\b(?:nsw|new\s+south\s+wales|hripa)\b.*\bchild.*patient\b/i.test(input))
                return true;
            if (/\bunder[\s-]*18\b.*\b(?:nsw|new\s+south\s+wales|hripa)\b/i.test(input))
                return true;
            if (/\b(?:nsw|new\s+south\s+wales|hripa)\b.*\bunder[\s-]*18\b/i.test(input))
                return true;
            return false;
        },
    },
};
export const AU_NSW_HRIPA_PACK = {
    categoryClassifiers: AU_NSW_HRIPA_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: NSW health information is subject-keyed by patient identifier.
     * HPP 10 transborder enforcement, HPP 11/12 access/correction SLAs, and
     * retention tracking all require per-patient identity correlation.
     * NSW_HEALTH_TRANSBORDER_TRANSFER is also subject-keyed because each
     * potential transborder transfer involves a specific patient record.
     */
    subjectKeyedCategories: [
        'NSW_HEALTH_INFORMATION',
        'NSW_HEALTH_TRANSBORDER_TRANSFER',
        'NSW_HEALTH_RESEARCH_USE',
        'NSW_HEALTH_MINOR_RECORD',
    ],
    id: 'au-nsw-hripa',
    name: 'NSW Health Records and Information Privacy Act 2002 (HRIPA)',
    version: '1.0.0',
    description: 'NSW HRIPA 2002 compliance for AI systems processing health information in New South Wales. ' +
        'Enforces HPP 10 transborder transfer BLOCK (consent or equivalent-protection required), ' +
        'HPP 14 research ethics gate, 30-day access/correction SLA (HPP 11/12), ' +
        'IPC NSW-administered enforcement, and retention per State Records Act 1998 (NSW) ' +
        '(7 years adult; 10 years from age 18 for minors). ' +
        'Civil penalty: AUD 22,000 per body corporate per contravention. ' +
        '[CITATION TO VERIFY: IPC NSW position on intra-AU equivalent-protection under HPP 10.]',
    authority: 'IPC NSW (Information and Privacy Commission NSW)',
    industries: [
        'healthcare', 'hospitals', 'digital-health',
        'allied-health', 'medical-research', 'aged-care',
        'mental-health', 'health-it',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'HPP 10 transborder block; HPP 14 research ethics approval gate; 30-day access SLA enforcement',
            reference: 'NSW HRIPA HPP 10, HPP 14',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '7-year (adult) / 10-year-from-18 (minor) retention; tamper-evident audit trail',
            reference: 'NSW HRIPA Regulation 2017; State Records Act 1998 (NSW)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'HPP 9 data security; health info is sensitive PI; AES-256 required',
            reference: 'NSW HRIPA HPP 9; Privacy Act APP 11',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify NSW health information; detect transborder transfers and research use',
            reference: 'NSW HRIPA HPP 1, HPP 10',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'HPP 10: vendor server location confirmation required; NSW data must not transfer outside NSW without consent or equivalent protection',
            reference: 'NSW HRIPA HPP 10',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Transborder transfer approval gate; research ethics confirmation (HPP 14)',
            reference: 'NSW HRIPA HPP 10, HPP 14',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-patient rights tracking; access/correction SLA 30 days; minor retention schedule',
            reference: 'NSW HRIPA HPP 11, HPP 12; Regulation 2017',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Transborder transfer event stream; research ethics event; breach notification (NDB + IPC NSW)',
            reference: 'NSW HRIPA; Privacy Act NDB',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'HPP 2 collection notice requirement; HPP 9 notification of use/disclosure; inform individuals of AI use in health decisions',
            reference: 'NSW HRIPA HPP 2 (collection notice); HPP 9 (notification of use/disclosure)',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'NSW_HEALTH_INFORMATION',
                'NSW_HEALTH_TRANSBORDER_TRANSFER',
                'NSW_HEALTH_RESEARCH_USE',
                'NSW_HEALTH_MINOR_RECORD',
            ],
            nswTransborderBlockEnabled: true,
            nswResearchEthicsApprovalRequired: true,
            healthRecordAccessSlaDays: 30,
            healthCollectionNoticeActive: true,
            vendorServerLocationConfirmed: true,
            healthCorrectionSlaDays: 30,
            nswMinorRetentionFromAge18Years: 10,
        },
        'governance-runtime': {
            nswTransborderBlockEnabled: true,
            nswResearchEthicsApprovalRequired: true,
            auStateHealthAccessResponseDays: 30,
            healthCollectionNoticeActive: true,
            auStateHealthCorrectionResponseDays: 30,
        },
        'supply-chain': {
            vendorServerLocationRequired: true,
            auStateHealthServerLocationAustralia: true,
            nswEquivalentProtectionAssessmentRequired: true,
        },
        'session-persistence': {
            accessRequestSlaDays: 30,
            correctionRequestSlaDays: 30,
            auStateHealthMinorRetentionDays: 3650,
        },
        'approval-queue': {
            transborderTransferApprovalRequired: true,
            auStateHealthResearchEthicsApprovalRequired: true,
        },
        'transparency-injector': {
            auStateHealthCollectionNoticeEnabled: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'SERVER-LOCATION-DISCLOSED',
            'NSW-TRANSBORDER-CONTROLS',
            'ETHICS-APPROVAL-FOR-RESEARCH',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'NSW_HEALTH_INFORMATION',
            'NSW_HEALTH_TRANSBORDER_TRANSFER',
            'NSW_HEALTH_RESEARCH_USE',
            'NSW_HEALTH_MINOR_RECORD',
        ],
        categoryActions: {
            NSW_HEALTH_INFORMATION: 'REQUIRE_APPROVAL',
            NSW_HEALTH_TRANSBORDER_TRANSFER: 'BLOCK',
            NSW_HEALTH_RESEARCH_USE: 'REQUIRE_APPROVAL',
            NSW_HEALTH_MINOR_RECORD: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU-NSW'],
        // NSW State Records Act 1998 + HRIPA Regulation 2017:
        // 7 years from last service (adult); 10 years from age 18 (minor).
        // Conservative floor: 10 years. TGA SaMD overlap: 10y governs.
        auditLogRetentionDays: 3650, // 10 years conservative
        sessionRetentionDays: 3650,
        // F-NEW-VERA-PACK-C7-04 fix: incidentRetentionDays raised from 1825 (5y, NDB-aligned)
        // to 2555 (7y) to match NSW State Records Act 1998 + HRIPA Regulation 2017 minimum.
        // Incident records accompany the underlying health record and must survive for the
        // full retention window of that record. 5y would purge incident logs before the
        // underlying 7y record retention window closes. 2555 = 7 * 365.
        incidentRetentionDays: 2555, // 7 years (NSW State Records Act 1998 minimum)
        reference: 'NSW HRIPA Regulation 2017: 7y adult / 10y-from-18 minor. State Records Act 1998 (NSW). TGA SaMD overlap: 10y governs SaMD records. Conservative floor: 10y. Incident records: 7y minimum aligned to record retention.',
    },
    incidentPolicy: {
        notificationDeadlineHours: 720, // 30-day NDB baseline; IPC NSW also notified
        reference: 'Federal Privacy Act Part IIIC NDB (30d baseline); IPC NSW notified for serious NSW health privacy breaches',
        requiredRecipients: ['nsw-ipc', 'oaic'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-nsw-hripa-transborder-block',
            description: 'NSW health information transfer outside NSW blocked without consent or equivalent-protection confirmation (HPP 10)',
            reference: 'NSW HRIPA 2002 HPP 10',
            check: 'au_nsw_hripa_transborder_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-nsw-hripa-research-ethics',
            description: 'AI training or secondary analysis on NSW health data requires ethics approval or de-identification (HPP 14)',
            reference: 'NSW HRIPA HPP 14',
            check: 'au_nsw_hripa_research_ethics_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-nsw-hripa-access-30d',
            description: 'NSW health record access requests actioned within 30 days (HPP 11)',
            reference: 'NSW HRIPA HPP 11',
            check: 'au_nsw_hripa_access_30d_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-nsw-hripa-collection-notice',
            description: 'Collection notice presented before or at collection of NSW health information (HPP 5)',
            reference: 'NSW HRIPA HPP 5',
            check: 'au_nsw_hripa_collection_notice_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-nsw-hripa-server-location',
            description: 'Vendor server location confirmed for NSW data to support HPP 10 transborder assessment',
            reference: 'NSW HRIPA 2002 HPP 10',
            check: 'au_nsw_hripa_server_location_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-nsw-hripa-correction-30d',
            description: 'NSW health information correction requests actioned within 30 days (HPP 12)',
            reference: 'NSW HRIPA HPP 12',
            check: 'au_nsw_hripa_correction_30d_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'au-nsw-hripa-minor-retention',
            description: 'NSW minor patient health records retained minimum 10 years from age 18',
            reference: 'NSW HRIPA Regulation 2017',
            check: 'au_nsw_hripa_minor_retention_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-nsw-hripa.js.map