"use strict";
/**
 * ACT Health Records (Privacy and Access) Act 1997 (HRPAA)
 *
 * Single-jurisdiction pack for the ACT Health Records (Privacy and Access) Act 1997.
 * Disaggregated from the former au-state-health-privacy umbrella pack
 * (X1-disaggregation, 2026-04-24).
 *
 * Administered by: ACT Human Rights Commission (HRC).
 * Scope: ACT health service providers including public hospitals, private clinics,
 * allied health practitioners, and EHR/digital health systems operating in the
 * Australian Capital Territory.
 *
 * 12 Health Privacy Principles (HPPs):
 *   HPP 1  Manner of collection
 *   HPP 2  Solicited collection
 *   HPP 3  Unsolicited information
 *   HPP 4  Anonymity
 *   HPP 5  Notification
 *   HPP 6  Use and disclosure
 *   HPP 7  Correction
 *   HPP 8  Access -- HRPAA s.7 creates a positive right to access health records;
 *          30-day response obligation; more procedurally specific than federal APP 12.
 *   HPP 9  Data quality
 *   HPP 10 Data security
 *   HPP 11 Identifiers
 *   HPP 12 Sensitive health information
 *
 * HRPAA s.7 access right: A person who is the subject of health records held by
 * a health service provider in the ACT has a right to inspect and obtain a copy.
 * The 30-day response SLA is procedurally specific and stricter than APP 12 in
 * some respects (affirmative obligation framing).
 *
 * Retention: 7 years from last service entry (consistent with federal APP 11
 * and ACT government records standards). No separate mental health extended
 * retention under HRPAA (contrast VIC HRA 25y mental health).
 *
 * Civil penalties: AUD 50,000 per body corporate (civil). Highest civil penalty
 * among the three state/territory health acts.
 *
 * Cross-pack interactions:
 *   - au-act-hrpaa + au-privacy-act: ACT HRPAA overlays federal APPs. Federal NDB
 *     scheme applies to all APP entities. Strictest-wins.
 *   - au-act-hrpaa + au-nsw-hripa + au-vic-hra: Cross-state hospital networks
 *     operating across NSW/VIC/ACT must satisfy all three packs. ACT HRPAA civil
 *     penalty (AUD 50,000) is the highest of the three; VIC HRA mental health
 *     retention (25y) is strictest retention rule.
 *   - au-act-hrpaa + hipaa (cross-border): AU hospital (Canberra-based) sending
 *     research data to US partner -- ACT HRPAA governs AU-side disclosure;
 *     HIPAA de-identification safe harbor governs US-side.
 *   - au-act-hrpaa + au-tga-saimd: TGA 10-year documentation overlaps ACT HRPAA
 *     7-year retention. TGA governs for SaMD-associated ACT patient data.
 *   - au-act-hrpaa + au-mandatory-ai-guardrails: Healthcare = proposed high-risk
 *     setting. HRPAA s.7 access right adds procedural specificity within proposed
 *     mandatory guardrail G8 (review/redress/appeal).
 *
 * Authority: ACT Human Rights Commission (HRC)
 * Sovereignty: ACT Territory
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AU_ACT_HRPAA_PACK = exports.AU_ACT_HRPAA_CATEGORY_CLASSIFIERS = void 0;
exports.AU_ACT_HRPAA_CATEGORY_CLASSIFIERS = {
    ACT_HEALTH_INFORMATION: {
        references: ['ACT HRPAA 1997 HPP 1 -- health information in ACT; ACT Human Rights Commission'],
        classifier: (input) => {
            if (/\b(?:act\s+(?:health\s+(?:information|record|data)|hrpaa\b|health\s+records)|health\s+information.*(?:act\s+government|canberra|australian\s+capital\s+territory))\b/i.test(input))
                return true;
            // ACT HRC-specific references
            if (/\b(?:act\s+human\s+rights\s+commission|hrpaa|health\s+records.*privacy.*access.*act)\b/i.test(input))
                return true;
            return false;
        },
    },
    ACT_HEALTH_ACCESS_REQUEST: {
        references: ['ACT HRPAA s.7 -- positive right to access health records within 30 days'],
        classifier: (input) => {
            if (/\b(?:act.*health.*(?:access\s+request|right\s+to\s+access|30.day.*access)|hrpaa\s+s(?:ection)?\.?\s*7|health\s+record\s+access.*canberra|act\s+health.*record.*access\s+right)\b/i.test(input))
                return true;
            return false;
        },
    },
    ACT_HEALTH_RESEARCH_USE: {
        references: ['ACT HRPAA HPP 6 -- use and disclosure; secondary use for research requires exception or consent'],
        classifier: (input) => {
            if (/\b(?:(?:ai\s+training|research|secondary\s+analysis).*act\s+(?:health|patient)\s+(?:data|record)|act\s+health.*(?:ai\s+training|research\s+use)|act\s+(?:territory|government).*health.*research)\b/i.test(input))
                return true;
            return false;
        },
    },
};
exports.AU_ACT_HRPAA_PACK = {
    categoryClassifiers: exports.AU_ACT_HRPAA_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: ACT health information is subject-keyed by patient identifier.
     * HRPAA s.7 access right and HPP 7 correction obligation both require
     * per-patient request tracking. ACT_HEALTH_ACCESS_REQUEST is also
     * subject-keyed because the s.7 right is a personal (not institutional) right.
     */
    subjectKeyedCategories: [
        'ACT_HEALTH_INFORMATION',
        'ACT_HEALTH_ACCESS_REQUEST',
        'ACT_HEALTH_RESEARCH_USE',
    ],
    id: 'au-act-hrpaa',
    name: 'ACT Health Records (Privacy and Access) Act 1997 (HRPAA)',
    version: '1.0.0',
    contentHash: '029b0e0e3e78fa6d7cbe6d8f498940d93f97e8aaff3e3020d25938d313634e12',
    description: 'ACT HRPAA 1997 compliance for AI systems processing health information in the Australian ' +
        'Capital Territory. Enforces HRPAA s.7 positive 30-day access right (procedurally stricter ' +
        'than federal APP 12), HPP 6 use/disclosure limits, HPP 10 data security, ' +
        'and ACT Human Rights Commission enforcement. ' +
        'Civil penalty: AUD 50,000 per body corporate (highest of the three AU state/territory health acts). ' +
        'Retention: 7 years from last service entry.',
    authority: 'ACT Human Rights Commission (HRC)',
    industries: [
        'healthcare', 'hospitals', 'digital-health',
        'allied-health', 'medical-research', 'aged-care',
        'mental-health', 'health-it',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'HRPAA s.7 access right enforcement; 30-day response SLA; HPP 6 use/disclosure gate',
            reference: 'ACT HRPAA s.7; HPP 6, HPP 8',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: '7-year retention from last service entry; tamper-evident audit trail',
            reference: 'ACT HRPAA; ACT government records standards',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'HPP 10 data security; sensitive health info; AES-256 required',
            reference: 'ACT HRPAA HPP 10; Privacy Act APP 11',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify ACT health information; detect access requests, research use',
            reference: 'ACT HRPAA HPP 1, HPP 6',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'HRPAA s.7 access request workflow; HPP 6 research/disclosure approval',
            reference: 'ACT HRPAA s.7; HPP 6',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-patient rights tracking; s.7 access SLA 30 days; 7-year retention schedule',
            reference: 'ACT HRPAA s.7, HPP 7',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'Breach notification (NDB + ACT Human Rights Commission)',
            reference: 'ACT HRPAA; Privacy Act NDB',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'HPP 4 collection notice requirement; HPP 8 disclosure notification; inform individuals of AI use in health decisions',
            reference: 'ACT HRPAA HPP 4 (collection notice); HPP 8 (notification of use/disclosure)',
        },
        {
            name: 'supply-chain',
            required: true,
            // F-NEW-VERA-PACK-C7-08 (2026-05-03): supply-chain was present in au-nsw-hripa but
            // missing here. ACT health information processed by AI vendors requires vendor
            // contracts mandating AU data residency and ACT Human Rights Commission
            // audit-rights provisions. au-nsw-hripa already had this module; parity required.
            reason: 'ACT health information vendors must be contractually bound to AU data residency; ACT Human Rights Commission audit rights; HPP 10 security obligations extend to processors and sub-processors',
            reference: 'ACT HRPAA HPP 10 (security obligations on processors); Privacy Act APP 8 (cross-border disclosure); AU data residency requirement for health information',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'ACT_HEALTH_INFORMATION',
                'ACT_HEALTH_ACCESS_REQUEST',
                'ACT_HEALTH_RESEARCH_USE',
            ],
            actHealthAccessSlaDays: 30,
            healthCollectionNoticeActive: true,
            healthCorrectionSlaDays: 30,
        },
        'governance-runtime': {
            auStateHealthAccessResponseDays: 30,
            healthCollectionNoticeActive: true,
            auStateHealthCorrectionResponseDays: 30,
        },
        'session-persistence': {
            accessRequestSlaDays: 30,
            correctionRequestSlaDays: 30,
        },
        'approval-queue': {
            actHealthAccessRequestWorkflowRequired: true,
        },
        'transparency-injector': {
            auStateHealthCollectionNoticeEnabled: true,
        },
        'supply-chain': {
            vendorServerLocationRequired: true,
            auStateHealthVendorContractRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'ACT-HEALTH-ACCESS-WORKFLOW',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'ACT_HEALTH_INFORMATION',
            'ACT_HEALTH_ACCESS_REQUEST',
            'ACT_HEALTH_RESEARCH_USE',
        ],
        categoryActions: {
            ACT_HEALTH_INFORMATION: 'REQUIRE_APPROVAL',
            ACT_HEALTH_ACCESS_REQUEST: 'REQUIRE_APPROVAL',
            ACT_HEALTH_RESEARCH_USE: 'REQUIRE_APPROVAL',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        // ACT HRPAA: 7 years from last service entry.
        // TGA SaMD overlap: TGA 10y governs SaMD-associated ACT patient data.
        // Conservative floor for cross-pack consistency: 7 years.
        auditLogRetentionDays: 2555, // 7 years (ACT standard)
        sessionRetentionDays: 2555,
        // F-NEW-VERA-PACK-C7-05 fix: incidentRetentionDays raised from 1825 (5y, NDB-aligned)
        // to 2555 (7y) to match ACT HRPAA 7-year record retention minimum.
        // Incident records accompany the underlying health record and must survive for the
        // full retention window of that record. 5y would purge incident logs before the
        // underlying 7y record retention window closes. 2555 = 7 * 365.
        incidentRetentionDays: 2555, // 7 years (ACT HRPAA minimum)
        reference: 'ACT HRPAA: 7 years from last service entry. TGA SaMD overlap: 10y governs SaMD records. Incident records: 7y minimum aligned to record retention.',
    },
    incidentPolicy: {
        notificationDeadlineHours: 720, // 30-day NDB baseline; ACT HRC also notified
        reference: 'Federal Privacy Act Part IIIC NDB (30d baseline); ACT Human Rights Commission notified for serious ACT health record breaches',
        requiredRecipients: ['act-human-rights-commission', 'oaic'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-act-hrpaa-access-30d',
            description: 'ACT health record access requests actioned within 30 days (HRPAA s.7 positive access right)',
            reference: 'ACT HRPAA s.7',
            check: 'au_act_hrpaa_access_30d_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-act-hrpaa-collection-notice',
            description: 'Collection notice presented before or at collection of ACT health information (HPP 5)',
            reference: 'ACT HRPAA HPP 5',
            check: 'au_act_hrpaa_collection_notice_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-act-hrpaa-data-security',
            description: 'ACT health information protected with reasonable security measures (HPP 10)',
            reference: 'ACT HRPAA HPP 10',
            check: 'au_act_hrpaa_data_security_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-act-hrpaa-correction-30d',
            description: 'ACT health information correction requests actioned within 30 days (HPP 7)',
            reference: 'ACT HRPAA HPP 7',
            check: 'au_act_hrpaa_correction_30d_active',
            failSeverity: 'MEDIUM',
        },
        {
            id: 'au-act-hrpaa-retention-7y',
            description: 'ACT health records retained for minimum 7 years from last service entry',
            reference: 'ACT HRPAA; ACT government records standards',
            check: 'au_act_hrpaa_retention_7y_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-act-hrpaa.js.map