/**
 * 42 CFR Part 2 Compliance Controls
 *
 * Confidentiality of Substance Use Disorder Patient Records
 * (Stricter than HIPAA for SUD treatment records)
 *
 * @module compliance/cfr42-part2
 */
/**
 * 42 CFR Part 2 control categories
 */
export const CFR42_PART2_CATEGORIES = [
    "General Provisions",
    "Disclosures With Consent",
    "Disclosures Without Consent",
    "Security Safeguards",
    "Audit and Accountability",
    "Re-disclosure Restrictions",
    "Qualified Service Organizations",
    "Patient Rights",
];
/**
 * 42 CFR Part 2 controls for SUD confidentiality
 *
 * These controls are STRICTER than HIPAA and apply specifically to
 * substance use disorder (SUD) treatment records.
 */
export const CFR42_PART2_CONTROLS = [
    // General Provisions (Subpart B)
    {
        id: "2.12",
        framework: "42-CFR-PART-2",
        category: "General Provisions",
        title: "Prohibition on Disclosure",
        description: "Records of the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with the performance of any SUD program shall be confidential and disclosed only as permitted.",
        keywords: [
            "substance use",
            "SUD",
            "confidential",
            "disclosure",
            "patient record",
            "addiction",
            "treatment",
        ],
        findingCategories: [
            "phi-exposure",
            "sud-disclosure",
            "data-exposure",
            "logging",
        ],
        cweIds: ["CWE-200", "CWE-532", "CWE-359"],
        severityThreshold: "high",
    },
    {
        id: "2.13",
        framework: "42-CFR-PART-2",
        category: "General Provisions",
        title: "Confidentiality Restrictions",
        description: "Part 2 programs, lawful holders, and other individuals may not disclose patient identifying information or seek, use, or disclose records except as permitted by Part 2.",
        keywords: [
            "confidentiality",
            "restrictions",
            "patient identifying information",
            "lawful holder",
        ],
        findingCategories: [
            "phi-exposure",
            "access-control-gap",
            "authorization",
            "broken-access-control",
        ],
        cweIds: ["CWE-284", "CWE-862", "CWE-863"],
        severityThreshold: "high",
    },
    {
        id: "2.14",
        framework: "42-CFR-PART-2",
        category: "General Provisions",
        title: "Minor Patient Consent",
        description: "When state law requires parental consent for SUD treatment of a minor, consent for disclosure must come from both the minor and parent/guardian.",
        keywords: [
            "minor",
            "parental consent",
            "guardian",
            "age verification",
            "dual consent",
        ],
        findingCategories: ["consent-bypass", "consent-missing", "authorization"],
        cweIds: ["CWE-862"],
        severityThreshold: "medium",
    },
    {
        id: "2.15",
        framework: "42-CFR-PART-2",
        category: "General Provisions",
        title: "Incompetent Patient Consent",
        description: "For patients lacking capacity, consent must be obtained from guardian or authorized representative with patient notification.",
        keywords: [
            "incompetent",
            "guardian",
            "authorized representative",
            "capacity",
        ],
        findingCategories: ["consent-bypass", "consent-missing", "authorization"],
        cweIds: ["CWE-862"],
        severityThreshold: "medium",
    },
    // Disclosures With Consent (Subpart C)
    {
        id: "2.31",
        framework: "42-CFR-PART-2",
        category: "Disclosures With Consent",
        title: "Written Consent Requirements",
        description: "Consent must be in writing and include: patient name, program name, recipient name, purpose, information to be disclosed, signature, date, expiration, and right to revoke.",
        keywords: [
            "written consent",
            "consent form",
            "signature",
            "expiration",
            "revocation",
            "purpose limitation",
        ],
        findingCategories: [
            "consent-bypass",
            "consent-missing",
            "authorization",
            "audit-gap",
        ],
        cweIds: ["CWE-862", "CWE-778"],
        severityThreshold: "high",
    },
    {
        id: "2.32",
        framework: "42-CFR-PART-2",
        category: "Re-disclosure Restrictions",
        title: "Re-disclosure Notice Requirement",
        description: "Each disclosure made with consent must include a written statement prohibiting re-disclosure except as permitted by Part 2.",
        keywords: [
            "re-disclosure",
            "prohibition notice",
            "downstream disclosure",
            "notice statement",
        ],
        findingCategories: [
            "redisclosure-violation",
            "third-party-risk",
            "data-flow",
        ],
        cweIds: ["CWE-200", "CWE-359"],
        severityThreshold: "high",
    },
    {
        id: "2.33",
        framework: "42-CFR-PART-2",
        category: "Qualified Service Organizations",
        title: "QSOA Requirements",
        description: "Qualified Service Organization Agreement required before disclosing records to contractors providing services to the program.",
        keywords: [
            "QSOA",
            "qualified service organization",
            "contractor",
            "third-party",
            "business associate",
            "vendor",
        ],
        findingCategories: [
            "qsoa-violation",
            "third-party-risk",
            "vendor",
            "supply-chain",
        ],
        cweIds: ["CWE-200"],
        severityThreshold: "high",
    },
    {
        id: "2.34",
        framework: "42-CFR-PART-2",
        category: "Disclosures With Consent",
        title: "Consent Revocation",
        description: "Patients may revoke consent at any time. Programs must honor revocation prospectively.",
        keywords: [
            "revocation",
            "revoke consent",
            "withdraw consent",
            "prospective",
        ],
        findingCategories: ["consent-bypass", "consent-missing", "authorization"],
        cweIds: ["CWE-862"],
        severityThreshold: "medium",
    },
    // Security Safeguards (Subpart B §2.16)
    {
        id: "2.16(a)",
        framework: "42-CFR-PART-2",
        category: "Security Safeguards",
        title: "Safeguards Against Unauthorized Access",
        description: "Part 2 programs must have formal policies and procedures to protect patient records from unauthorized access.",
        keywords: [
            "safeguards",
            "unauthorized access",
            "policies",
            "procedures",
            "access control",
        ],
        findingCategories: [
            "access-control-gap",
            "broken-access-control",
            "authorization",
            "authentication",
        ],
        cweIds: ["CWE-284", "CWE-287", "CWE-862"],
        severityThreshold: "high",
    },
    {
        id: "2.16(b)",
        framework: "42-CFR-PART-2",
        category: "Security Safeguards",
        title: "Electronic Records Security",
        description: "Programs maintaining electronic records must implement security measures including access controls, encryption, and audit trails.",
        keywords: [
            "electronic records",
            "encryption",
            "access control",
            "audit trail",
            "security measures",
        ],
        findingCategories: [
            "encryption",
            "missing-encryption",
            "access-control-gap",
            "audit-gap",
        ],
        cweIds: ["CWE-311", "CWE-312", "CWE-778"],
        severityThreshold: "high",
    },
    // Audit and Accountability
    {
        id: "2.52",
        framework: "42-CFR-PART-2",
        category: "Audit and Accountability",
        title: "Accounting of Disclosures",
        description: "Programs must maintain records of disclosures made with or without consent, including date, recipient, purpose, and information disclosed.",
        keywords: [
            "accounting",
            "disclosure log",
            "audit trail",
            "disclosure record",
            "recipient tracking",
        ],
        findingCategories: ["audit-gap", "logging", "insufficient-logging"],
        cweIds: ["CWE-778", "CWE-223"],
        severityThreshold: "high",
    },
    {
        id: "2.53",
        framework: "42-CFR-PART-2",
        category: "Audit and Accountability",
        title: "Breach Notification",
        description: "Programs must notify patients and HHS of breaches of unsecured SUD records.",
        keywords: [
            "breach",
            "notification",
            "incident response",
            "unsecured records",
        ],
        findingCategories: [
            "security-misconfiguration",
            "logging",
            "audit-gap",
        ],
        cweIds: ["CWE-778"],
        severityThreshold: "high",
    },
    // Disclosures Without Consent (Subpart D)
    {
        id: "2.51",
        framework: "42-CFR-PART-2",
        category: "Disclosures Without Consent",
        title: "Medical Emergency Exception",
        description: "Disclosure without consent permitted only for medical emergencies where delay would increase health risk.",
        keywords: [
            "medical emergency",
            "emergency disclosure",
            "health risk",
            "exception",
        ],
        findingCategories: ["consent-bypass", "audit-gap", "logging"],
        cweIds: ["CWE-778"],
        severityThreshold: "medium",
    },
    {
        id: "2.63",
        framework: "42-CFR-PART-2",
        category: "Disclosures Without Consent",
        title: "Research Exception Requirements",
        description: "Research disclosures require IRB/Privacy Board approval, data use agreement, and prohibition on re-identification.",
        keywords: [
            "research",
            "IRB",
            "privacy board",
            "data use agreement",
            "de-identification",
        ],
        findingCategories: ["consent-bypass", "authorization", "audit-gap"],
        cweIds: ["CWE-359"],
        severityThreshold: "medium",
    },
    // Patient Rights
    {
        id: "2.23",
        framework: "42-CFR-PART-2",
        category: "Patient Rights",
        title: "Patient Access to Records",
        description: "Patients have the right to inspect and obtain copies of their SUD treatment records upon request.",
        keywords: ["patient access", "record access", "copy", "inspect", "request"],
        findingCategories: ["access-control-gap", "authorization"],
        cweIds: ["CWE-284"],
        severityThreshold: "low",
    },
    {
        id: "2.24",
        framework: "42-CFR-PART-2",
        category: "Patient Rights",
        title: "Patient Amendment Rights",
        description: "Patients may request amendment of inaccurate or incomplete records.",
        keywords: ["amendment", "correction", "inaccurate", "incomplete"],
        findingCategories: ["data-integrity", "authorization"],
        severityThreshold: "low",
    },
    // Additional Technical Controls
    {
        id: "2.16(c)",
        framework: "42-CFR-PART-2",
        category: "Security Safeguards",
        title: "Data Transmission Security",
        description: "SUD records transmitted electronically must be encrypted and protected against interception.",
        keywords: [
            "transmission",
            "encryption",
            "TLS",
            "HTTPS",
            "interception",
            "network security",
        ],
        findingCategories: [
            "transport-security",
            "encryption",
            "insecure-transmission",
        ],
        cweIds: ["CWE-319", "CWE-523"],
        severityThreshold: "high",
    },
    {
        id: "2.16(d)",
        framework: "42-CFR-PART-2",
        category: "Security Safeguards",
        title: "Data Segmentation",
        description: "SUD records should be segmented from general health records to prevent inadvertent disclosure under HIPAA.",
        keywords: [
            "segmentation",
            "segregation",
            "separate storage",
            "data isolation",
        ],
        findingCategories: ["access-control-gap", "data-exposure", "phi-exposure"],
        cweIds: ["CWE-284", "CWE-668"],
        severityThreshold: "high",
    },
];
/**
 * Get all 42 CFR Part 2 controls
 */
export function getCFR42Part2Controls() {
    return CFR42_PART2_CONTROLS;
}
/**
 * Get 42 CFR Part 2 controls by category
 */
export function getCFR42Part2ControlsByCategory(category) {
    return CFR42_PART2_CONTROLS.filter((c) => c.category === category);
}
/**
 * Get 42 CFR Part 2 control by ID
 */
export function getCFR42Part2ControlById(id) {
    return CFR42_PART2_CONTROLS.find((c) => c.id === id);
}
/**
 * Get 42 CFR Part 2 categories
 */
export function getCFR42Part2Categories() {
    return CFR42_PART2_CATEGORIES;
}
/**
 * Cross-reference mapping to HIPAA controls
 * 42 CFR Part 2 often overlaps with but is stricter than HIPAA
 */
export const CFR42_TO_HIPAA_MAPPING = {
    "2.12": ["164.308(a)(1)", "164.312(a)(1)"],
    "2.13": ["164.308(a)(4)", "164.312(a)(1)"],
    "2.16(a)": ["164.312(a)(1)", "164.308(a)(3)"],
    "2.16(b)": ["164.312(a)(2)(iv)", "164.312(b)"],
    "2.16(c)": ["164.312(e)(1)", "164.312(e)(2)(ii)"],
    "2.31": ["164.508"],
    "2.52": ["164.312(b)", "164.528"],
    "2.53": ["164.402", "164.404"],
};
//# sourceMappingURL=cfr42-part2.js.map