"use strict";
/**
 * HIPAA per-framework narrative prompt context.
 *
 * Declares section headings, evidence-linkage requirements, and required
 * control mappings for HIPAA-scoped compliance narratives.
 *
 * References:
 *   45 CFR Part 164 -- HIPAA Security Rule
 *   45 CFR Part 164.400-414 -- HIPAA Breach Notification Rule
 *   NIST SP 800-66r2 (HIPAA Security Rule implementation guidance)
 *
 * Spec: P4-AIR-02 AC 4-6
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.HIPAA_PROMPT_SPEC = void 0;
exports.HIPAA_PROMPT_SPEC = {
    frameworkId: 'hipaa',
    frameworkName: 'HIPAA Security Rule',
    version: '45 CFR Part 164 (2013 Omnibus Final Rule)',
    sections: [
        {
            sectionId: 'hipaa-164-308-administrative',
            heading: '164.308 Administrative Safeguards',
            regulatoryRef: '45 CFR 164.308(a)(1)-(a)(8)',
            requiredEventTypes: ['agent:registered', 'governance:verdict', 'approval:decided'],
            controlMappings: [
                '164.308(a)(1) -- Security Management Process',
                '164.308(a)(3) -- Workforce Authorization and Supervision',
                '164.308(a)(4) -- Information Access Management',
                '164.308(a)(5) -- Security Awareness Training',
                '164.308(a)(6) -- Security Incident Procedures',
                '164.308(a)(7) -- Contingency Plan',
                '164.308(a)(8) -- Evaluation',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Describe administrative safeguards implemented by the AI governance platform. ' +
                'For each required implementation specification (risk analysis, workforce training, ' +
                'access management, incident procedures), cite the audit-chain events that demonstrate ' +
                'operating effectiveness. Quantify the number of policy enforcement events, ' +
                'agent access changes, and incident escalations during the review period.',
        },
        {
            sectionId: 'hipaa-164-310-physical',
            heading: '164.310 Physical Safeguards',
            regulatoryRef: '45 CFR 164.310(a)-(d)',
            requiredEventTypes: ['agent:registered'],
            controlMappings: [
                '164.310(a)(1) -- Facility Access Controls',
                '164.310(b) -- Workstation Use',
                '164.310(c) -- Workstation Security',
                '164.310(d)(1) -- Device and Media Controls',
            ],
            citationRequirement: 'optional',
            promptGuidance: 'Describe physical safeguards as they apply to AI agent workstations and ' +
                'deployment environments. Address facility access, workstation security ' +
                'configurations, and device controls relevant to ePHI processing.',
        },
        {
            sectionId: 'hipaa-164-312-technical',
            heading: '164.312 Technical Safeguards',
            regulatoryRef: '45 CFR 164.312(a)-(e)',
            requiredEventTypes: ['governance:verdict', 'action:denied'],
            controlMappings: [
                '164.312(a)(1) -- Access Control (unique user ID, automatic logoff, encryption)',
                '164.312(b) -- Audit Controls',
                '164.312(c)(1) -- Integrity (ePHI alteration detection)',
                '164.312(d) -- Person or Entity Authentication',
                '164.312(e)(1) -- Transmission Security',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Document technical safeguards enforced by the governance runtime. ' +
                'Cite audit-chain events demonstrating: unique AI agent identification, ' +
                'automatic session termination, audit logging completeness, PHI integrity ' +
                'verification, and transmission encryption enforcement. ' +
                'Include deny-decision counts as evidence of access control effectiveness.',
        },
        {
            sectionId: 'hipaa-164-530-breach',
            heading: '164.400-414 Breach Notification Obligations',
            regulatoryRef: '45 CFR 164.400-414',
            requiredEventTypes: ['incident:created'],
            controlMappings: [
                '164.410 -- Notification to Individuals',
                '164.412 -- Notification to Media',
                '164.414 -- Notification to Secretary',
            ],
            citationRequirement: 'required',
            promptGuidance: 'Summarise breach-notification posture for the review period. ' +
                'Cite any incident events and describe the notification timeline, ' +
                'affected ePHI scope, and corrective actions taken. If no breaches occurred, ' +
                'document the absence of qualifying incidents with chain evidence.',
        },
    ],
};
//# sourceMappingURL=hipaa.js.map