/**
 * HIPAA Security Rule Controls
 *
 * Health Insurance Portability and Accountability Act
 *
 * @module compliance/hipaa
 */
/**
 * HIPAA safeguard categories
 */
export const HIPAA_CATEGORIES = [
    "Administrative Safeguards",
    "Physical Safeguards",
    "Technical Safeguards",
];
/**
 * HIPAA Security Rule controls relevant to code security
 */
export const HIPAA_CONTROLS = [
    // Administrative Safeguards (§164.308)
    {
        id: "164.308(a)(1)",
        framework: "HIPAA",
        category: "Administrative Safeguards",
        title: "Security Management Process",
        description: "Implement policies and procedures to prevent, detect, contain, and correct security violations.",
        keywords: ["security-management", "policy", "procedures", "PHI", "ePHI"],
        findingCategories: ["security", "policy", "phi-exposure", "consent-bypass", "audit-gap"],
        cweIds: ["CWE-200", "CWE-359"],
    },
    {
        id: "164.308(a)(3)",
        framework: "HIPAA",
        category: "Administrative Safeguards",
        title: "Workforce Security",
        description: "Implement policies and procedures to ensure appropriate access to ePHI.",
        keywords: ["workforce", "access", "authorization"],
        findingCategories: ["authorization", "access-control"],
        cweIds: ["CWE-284"],
    },
    {
        id: "164.308(a)(4)",
        framework: "HIPAA",
        category: "Administrative Safeguards",
        title: "Information Access Management",
        description: "Implement policies and procedures for authorizing access to ePHI.",
        keywords: ["access-management", "authorization", "PHI", "ePHI", "minimum necessary"],
        findingCategories: ["authorization", "data-exposure", "phi-exposure", "consent-bypass", "broken-access-control"],
        cweIds: ["CWE-284", "CWE-285", "CWE-862"],
    },
    {
        id: "164.308(a)(5)",
        framework: "HIPAA",
        category: "Administrative Safeguards",
        title: "Security Awareness and Training",
        description: "Implement a security awareness and training program for workforce members.",
        keywords: ["training", "awareness", "security"],
        findingCategories: ["security"],
    },
    {
        id: "164.308(a)(6)",
        framework: "HIPAA",
        category: "Administrative Safeguards",
        title: "Security Incident Procedures",
        description: "Implement policies and procedures to address security incidents.",
        keywords: ["incident", "response", "security"],
        findingCategories: ["security", "logging"],
    },
    // Technical Safeguards (§164.312)
    {
        id: "164.312(a)(1)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Access Control",
        description: "Implement technical policies and procedures for electronic information systems that maintain ePHI.",
        keywords: ["access-control", "authentication", "authorization"],
        findingCategories: ["authentication", "authorization"],
        cweIds: ["CWE-284", "CWE-287"],
    },
    {
        id: "164.312(a)(2)(i)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Unique User Identification",
        description: "Assign a unique name and/or number for identifying and tracking user identity.",
        keywords: ["user-id", "identity", "tracking"],
        findingCategories: ["authentication", "identity"],
        cweIds: ["CWE-287"],
    },
    {
        id: "164.312(a)(2)(ii)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Emergency Access Procedure",
        description: "Establish procedures for obtaining necessary ePHI during an emergency.",
        keywords: ["emergency", "access", "procedure"],
        findingCategories: ["availability", "access-control"],
    },
    {
        id: "164.312(a)(2)(iii)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Automatic Logoff",
        description: "Implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.",
        keywords: ["session", "timeout", "logoff"],
        findingCategories: ["authentication", "session-management"],
        cweIds: ["CWE-613"],
    },
    {
        id: "164.312(a)(2)(iv)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Encryption and Decryption",
        description: "Implement a mechanism to encrypt and decrypt ePHI.",
        keywords: ["encryption", "decryption", "cryptography", "PHI", "at rest", "in transit"],
        findingCategories: ["encryption", "data-protection", "missing-encryption", "phi-exposure", "cryptographic-failure"],
        cweIds: ["CWE-311", "CWE-312", "CWE-326"],
        severityThreshold: "high",
    },
    {
        id: "164.312(b)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Audit Controls",
        description: "Implement hardware, software, and/or procedural mechanisms to record and examine activity.",
        keywords: ["audit", "logging", "monitoring", "access log", "PHI access"],
        findingCategories: ["logging", "audit", "audit-gap", "phi-in-logs", "insufficient-logging"],
        cweIds: ["CWE-778", "CWE-532", "CWE-223"],
        severityThreshold: "medium",
    },
    {
        id: "164.312(c)(1)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Integrity",
        description: "Implement policies and procedures to protect ePHI from improper alteration or destruction.",
        keywords: ["integrity", "data-protection", "tampering"],
        findingCategories: ["integrity", "data-protection"],
        cweIds: ["CWE-354"],
    },
    {
        id: "164.312(c)(2)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Mechanism to Authenticate ePHI",
        description: "Implement electronic mechanisms to corroborate that ePHI has not been altered or destroyed.",
        keywords: ["authentication", "integrity", "verification"],
        findingCategories: ["integrity", "authentication"],
    },
    {
        id: "164.312(d)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Person or Entity Authentication",
        description: "Implement procedures to verify a person or entity seeking access is the one claimed.",
        keywords: ["authentication", "verification", "identity"],
        findingCategories: ["authentication"],
        cweIds: ["CWE-287", "CWE-306"],
    },
    {
        id: "164.312(e)(1)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Transmission Security",
        description: "Implement technical security measures to guard against unauthorized access to ePHI transmitted over networks.",
        keywords: ["transmission", "network", "encryption", "TLS"],
        findingCategories: ["transport-security", "encryption"],
        cweIds: ["CWE-319"],
    },
    {
        id: "164.312(e)(2)(i)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Integrity Controls for Transmission",
        description: "Implement security measures to ensure electronically transmitted ePHI is not improperly modified.",
        keywords: ["transmission", "integrity", "modification"],
        findingCategories: ["transport-security", "integrity"],
    },
    {
        id: "164.312(e)(2)(ii)",
        framework: "HIPAA",
        category: "Technical Safeguards",
        title: "Encryption for Transmission",
        description: "Implement a mechanism to encrypt ePHI whenever deemed appropriate.",
        keywords: ["encryption", "transmission", "TLS", "HTTPS"],
        findingCategories: ["encryption", "transport-security"],
        cweIds: ["CWE-319", "CWE-523"],
    },
];
/**
 * Get all HIPAA controls
 */
export function getHIPAAControls() {
    return HIPAA_CONTROLS;
}
/**
 * Get HIPAA controls by category
 */
export function getHIPAAControlsByCategory(category) {
    return HIPAA_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get HIPAA categories
 */
export function getHIPAACategories() {
    return HIPAA_CATEGORIES;
}
//# sourceMappingURL=hipaa.js.map