"use strict";
/**
 * No Surprises Act Compliance Pack
 *
 * P.L. 116-260 Division BB — No Surprises Act
 * 45 CFR Part 149 — Federal surprise billing protections
 *
 * Enforces 6 of 8 rules from rules.md:
 *   BLOCK: NSA-001 (GFE completeness), NSA-003 (balance billing emergency),
 *          NSA-004 (out-of-network consent)
 *   WARN:  NSA-002 (GFE timing), NSA-005 (provider directory accuracy),
 *          NSA-006 (continuity of care), NSA-007 (IDR submission elements)
 *   SKIP:  NSA-008 — human-attestation (language accessibility), not wired here
 *
 * @connexum/ai-governance | Kai (CXNI-005) | 2026-05-24
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.NO_SURPRISES_ACT_PACK = exports.NO_SURPRISES_ACT_CATEGORY_CLASSIFIERS = void 0;
exports.NO_SURPRISES_ACT_CATEGORY_CLASSIFIERS = {
    /**
     * NSA-001 — BLOCK
     * Good Faith Estimates for uninsured/self-pay patients must be complete.
     * Required fields: primary item cost, expected co-providers, total expected cost,
     * disclaimer language, provider NPI, facility NPI.
     * 45 CFR §149.610
     *
     * enforcement_pattern: semantic:gfe-completeness-check
     */
    GFE_INCOMPLETE: {
        references: ['45 CFR §149.610 — Good Faith Estimate required elements'],
        classifier: (input) => {
            // Must be a GFE document
            const isGFE = /\b(good\s+faith\s+estimate|GFE|self.?pay\s+(estimate|cost)|uninsured\s+(estimate|cost)|cost\s+estimate\s+for\s+(uninsured|self.?pay))\b/i.test(input);
            if (!isGFE)
                return false;
            // Check for required GFE elements (handles JSON field names and natural language)
            const hasPrimaryItemCost = /(primary\s+(service|item|procedure)\s+(cost|charge|amount)|expected\s+(cost|charge)\s+for\s+(primary|main|principal)|expected[_\s]charge|items[_\s]and[_\s]services)/i.test(input);
            const hasTotalExpectedCost = /(total[_\s]expected[_\s](cost|charge|amount)|total\s+expected\s+(cost|charge)|total\s+estimated\s+(cost|charge)|grand\s+total\s+(estimate|expected))/i.test(input);
            const hasDisclaimer = /(this\s+(estimate|GFE)\s+is\s+(an\s+estimate|not\s+a\s+final\s+(bill|charge))|GFE\s+disclaimer|estimate\s+disclaimer|actual\s+(charges|costs)\s+may\s+(differ|vary)|disclaimer["']?\s*:)/i.test(input);
            const hasProviderNPI = /(provider[_\s]npi|billing[_\s]npi|NPI[:\s]+\d{10})/i.test(input);
            // GFE is incomplete if missing any required element
            return !hasPrimaryItemCost || !hasTotalExpectedCost || !hasDisclaimer || !hasProviderNPI;
        },
    },
    /**
     * NSA-002 — WARN
     * GFE delivery timing must meet regulatory requirements relative to service date.
     * 45 CFR §149.610(b)(1)
     *
     * enforcement_pattern: semantic:gfe-timing-check
     */
    GFE_TIMING_NOT_DOCUMENTED: {
        references: ['45 CFR §149.610(b)(1) — GFE delivery timing requirements'],
        classifier: (input) => {
            // Must be a scheduling event for uninsured/self-pay patients
            const isSchedulingEvent = /\b(scheduling\s+(event|record|note)|appointment\s+(scheduled|booked|created)|visit\s+scheduled)\b/i.test(input);
            const isSelfPay = /(self.?pay|uninsured|no\s+insurance|cash\s+pay)/i.test(input);
            if (!isSchedulingEvent || !isSelfPay)
                return false;
            // Check for GFE delivery timestamp documentation
            const hasGfeDelivery = /(gfe[_\s]delivery[_\s](timestamp|date|time)|good\s+faith\s+estimate\s+(delivered?|sent|provided)\s+(at|on|by))/i.test(input);
            return !hasGfeDelivery;
        },
    },
    /**
     * NSA-003 — BLOCK
     * Balance billing is prohibited for emergency services regardless of network status.
     * Patient-facing bills must not include out-of-network cost-sharing for emergency services.
     * 45 CFR §149.30
     *
     * enforcement_pattern: regex for balance billing + emergency service codes
     */
    BALANCE_BILLING_EMERGENCY: {
        references: ['45 CFR §149.30 — Balance billing prohibition for emergency services'],
        classifier: (input) => {
            // Must contain balance billing / out-of-network amount language (handles "Out-of-Network Provider Charge" format)
            const hasBalanceBilling = /(balance\s+bill(ing)?|out.of.network\s+(provider\s+)?(amount|balance|charge|cost|bill)|non.participating\s+provider\s+amount|out.of.network\s+provider\s+charge)/i.test(input);
            if (!hasBalanceBilling)
                return false;
            // Check for emergency service context (CPT codes or emergency department references)
            const hasEmergencyContext = /(99281|99282|99283|99284|99285|99291|emergency\s+department|emergency\s+room|ER\s+(visit|charge)|ED\s+(visit|charge)|emergency\s+service)/i.test(input);
            return hasEmergencyContext;
        },
    },
    /**
     * NSA-004 — BLOCK
     * For non-emergency out-of-network services at in-network facilities,
     * balance billing requires patient notice and written consent.
     * 45 CFR §149.410
     *
     * enforcement_pattern: semantic:out-of-network-consent-check
     */
    OON_BILLING_MISSING_CONSENT: {
        references: ['45 CFR §149.410 — Out-of-network notice and consent requirement'],
        classifier: (input) => {
            // Must involve out-of-network scheduling/billing (check provider network status or OON flags)
            const hasOonContext = /(out.of.network\s+(provider|physician|billing)|non.participating\s+provider|OON\s+(provider|billing|charge)|network[_\s]status\s*==\s*["']?out[_\s]of[_\s]network|out[_\s]of[_\s]network[_\s]flag\s*[:=]\s*(True|true|1|yes))/i.test(input);
            if (!hasOonContext)
                return false;
            // Flag if consent is assumed/pre-checked (NSA violation) rather than affirmatively obtained
            const hasAssumedConsent = /(consent[_\s]assumed\s*[:=]\s*(True|true|1|yes)|consent[_\s]pre.?checked|pre.checked\s+consent)/i.test(input);
            if (hasAssumedConsent)
                return true;
            // Check for patient consent documentation (affirmative consent clears the flag)
            const hasConsent = /(patient[_\s]consent[_\s](obtained|provided|documented|date)|consent[_\s](obtained|documented)\s*[:=]\s*(true|yes)|written\s+consent\s+(signed|obtained|documented)|requires[_\s]explicit[_\s]patient[_\s]signature)/i.test(input);
            return !hasConsent;
        },
    },
    /**
     * NSA-005 — WARN
     * Provider directory entries must include network status accuracy indicators.
     * 45 CFR §149.410 and CMS transparency rules
     *
     * enforcement_pattern: semantic:provider-directory-accuracy
     */
    PROVIDER_DIRECTORY_ACCURACY: {
        references: ['45 CFR §149.410 — Provider directory accuracy; CMS transparency requirements'],
        classifier: (input) => {
            // Must be a provider directory update
            const isDirectoryUpdate = /\b(provider\s+directory\s+(update|entry|record|listing)|directory\s+(update|entry|record)|network\s+(directory|status)\s+update)\b/i.test(input);
            if (!isDirectoryUpdate)
                return false;
            // Check for verification source and last verified date
            const hasVerificationSource = /(network[_\s]verification[_\s]source|credentialing[_\s](source|data)|verification[_\s](source|method|basis))/i.test(input);
            const hasLastVerifiedDate = /(last[_\s]verified[_\s]date|verified[_\s]on|last[_\s]verification[_\s]date|network[_\s]status[_\s](as\s+of|verified\s+on))/i.test(input);
            return !hasVerificationSource || !hasLastVerifiedDate;
        },
    },
    /**
     * NSA-006 — WARN
     * Continuity of care: when a provider leaves a network mid-treatment,
     * patients continue care at in-network rates for up to 90 days.
     * 45 CFR §149.30(b)
     *
     * enforcement_pattern: semantic:continuity-of-care-flag
     */
    CONTINUITY_OF_CARE_OON_APPLIED: {
        references: ['45 CFR §149.30(b) — Continuity of care protection (90-day transition window)'],
        classifier: (input) => {
            // Must be a billing output with a provider who changed network status
            const hasNetworkStatusChange = /(provider[_\s]network[_\s]status[_\s](changed?|transitioned?|terminated?)|left\s+the\s+network|left\s+(our\s+)?network|no\s+longer\s+(in.?network|participating)|terminated\s+from\s+network)/i.test(input);
            if (!hasNetworkStatusChange)
                return false;
            // Check if out-of-network cost-sharing is being applied
            const hasOonCostSharing = /(out.of.network\s+(cost.?sharing|deductible|coinsurance|copay)|OON\s+(cost.?sharing|rate|amount))/i.test(input);
            if (!hasOonCostSharing)
                return false;
            // Check for course-of-treatment flag or continuity documentation
            const hasContinuityCheck = /(continuity\s+of\s+care|90.?day\s+(window|transition|protection)|course[_\s]of[_\s]treatment|active\s+course\s+of\s+treatment)/i.test(input);
            return !hasContinuityCheck;
        },
    },
    /**
     * NSA-007 — WARN
     * IDR submissions must include offer amount, qualifying payment amount (QPA),
     * good-faith attestation, and submission deadline met.
     * 45 CFR §149.510
     *
     * enforcement_pattern: semantic:idr-submission-completeness
     */
    IDR_SUBMISSION_INCOMPLETE: {
        references: ['45 CFR §149.510 — Independent Dispute Resolution submission requirements'],
        classifier: (input) => {
            // Must be an IDR submission document
            const isIDR = /\b(IDR\s+(submission|arbitration|filing)|independent\s+dispute\s+resolution\s+(submission|filing)|surprise\s+billing\s+arbitration)\b/i.test(input);
            if (!isIDR)
                return false;
            const hasOfferAmount = /(offer[_\s]amount|submitted\s+offer|arbitration\s+offer[:\s]+\$?\d)/i.test(input);
            const hasQPA = /(qualifying[_\s]payment[_\s]amount|QPA[:\s]+\$?\d|median\s+in.?network\s+rate)/i.test(input);
            const hasAttestation = /(good[_\s]faith[_\s]attestation|attestation\s+that\s+(this\s+is\s+a\s+good.faith|offer\s+is\s+good.faith)|good.faith\s+offer\s+(attested?|confirmed?))/i.test(input);
            return !hasOfferAmount || !hasQPA || !hasAttestation;
        },
    },
};
exports.NO_SURPRISES_ACT_PACK = {
    categoryClassifiers: exports.NO_SURPRISES_ACT_CATEGORY_CLASSIFIERS,
    id: 'no-surprises-act',
    name: 'No Surprises Act',
    version: '1.0.0',
    contentHash: '0d964bf18476dc7e5ec548cd7c5d33924fe77f8b0927cf2746cce0da55a0e3c6',
    description: 'Federal surprise billing protections under the No Surprises Act (P.L. 116-260 Div. BB). Covers Good Faith Estimate completeness and timing, balance billing prohibition for emergency services, out-of-network consent requirements, provider directory accuracy, continuity of care, and IDR process documentation.',
    authority: 'HHS / CMS / DOL / OPM — No Surprises Act implementing agencies',
    industries: ['healthcare', 'hospital', 'health-plan', 'physician-practice', 'health-it', 'billing'],
    requiredModules: [
        {
            name: 'audit-integrity',
            required: true,
            reason: 'GFE delivery and consent documentation audit trail',
            reference: '45 CFR §149.610, §149.410',
        },
        {
            name: 'governance-runtime',
            required: true,
            reason: 'Block balance billing for emergency services; enforce consent requirements',
            reference: '45 CFR §149.30, §149.410',
        },
    ],
    moduleConfig: {
        'audit-integrity': {
            retentionDays: 1825, // 5 years
        },
        'governance-runtime': {
            denyByDefaultRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'GFE_INCOMPLETE',
            'GFE_TIMING_NOT_DOCUMENTED',
            'BALANCE_BILLING_EMERGENCY',
            'OON_BILLING_MISSING_CONSENT',
            'PROVIDER_DIRECTORY_ACCURACY',
            'CONTINUITY_OF_CARE_OON_APPLIED',
            'IDR_SUBMISSION_INCOMPLETE',
        ],
        categoryActions: {
            GFE_INCOMPLETE: 'BLOCK',
            GFE_TIMING_NOT_DOCUMENTED: 'WARN',
            BALANCE_BILLING_EMERGENCY: 'BLOCK',
            OON_BILLING_MISSING_CONSENT: 'BLOCK',
            PROVIDER_DIRECTORY_ACCURACY: 'WARN',
            CONTINUITY_OF_CARE_OON_APPLIED: 'WARN',
            IDR_SUBMISSION_INCOMPLETE: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256-GCM',
        minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: {
        auditLogRetentionDays: 1825,
        sessionRetentionDays: 1825,
        incidentRetentionDays: 1825,
        reference: '45 CFR §149 — No Surprises Act records retention',
        forceDelete: false,
        requiresLegalHoldSupport: true,
        sovereignty: ['us'],
    },
    incidentPolicy: {
        notificationDeadlineHours: 168, // 7 days
        reference: '45 CFR §149 — No Surprises Act compliance enforcement',
        requiredRecipients: ['compliance-officer', 'billing-director'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'nsa-gfe-check',
            description: 'Good Faith Estimate completeness classifier active',
            reference: '45 CFR §149.610',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'nsa-balance-billing-check',
            description: 'Balance billing prohibition classifier for emergency services active',
            reference: '45 CFR §149.30',
            check: 'data_classifier_active',
            failSeverity: 'CRITICAL',
        },
    ],
    requiresRetrievalAuditLogging: true,
    maxAutonomyLevelWithoutAttestation: 2,
    recommendedHookProfile: 'strict',
};
//# sourceMappingURL=no-surprises-act.js.map