HIPAA Guidelines

// Example: Role-based access control for PHI
interface AccessPolicy {
  resource: string;
  actions: ('read' | 'write' | 'delete')[];
  roles: string[];
  conditions?: AccessCondition[];
}

const phiAccessPolicies: AccessPolicy[] = [
  {
    resource: 'patient-records',
    actions: ['read'],
    roles: ['physician', 'nurse', 'medical-assistant'],
    conditions: [
      { type: 'treatment-relationship', required: true },
    ],
  },
  {
    resource: 'patient-records',
    actions: ['read', 'write'],
    roles: ['physician'],
    conditions: [
      { type: 'treatment-relationship', required: true },
      { type: 'break-glass', required: false },
    ],
  },
];

// Enforce minimum necessary access
async function checkAccess(
  user: User,
  resource: string,
  action: string
): Promise<boolean> {
  const policy = findMatchingPolicy(resource, action);
  if (!policy) return false;

  if (!policy.roles.includes(user.role)) return false;

  for (const condition of policy.conditions || []) {
    if (!await evaluateCondition(condition, user, resource)) {
      return false;
    }
  }

  // Log access attempt
  await auditLog.record({
    userId: user.id,
    resource,
    action,
    timestamp: new Date(),
    granted: true,
  });

  return true;
}

// HIPAA-compliant audit logging
interface AuditEntry {
  timestamp: string;
  userId: string;
  userName: string;
  userRole: string;
  action: 'CREATE' | 'READ' | 'UPDATE' | 'DELETE' | 'EXPORT' | 'PRINT';
  resource: string;
  resourceId: string;
  patientId?: string;
  ipAddress: string;
  userAgent: string;
  outcome: 'SUCCESS' | 'FAILURE' | 'DENIED';
  reason?: string;
  dataAccessed?: string[]; // Fields accessed
}

class HipaaAuditLogger {
  async logAccess(entry: AuditEntry): Promise<void> {
    // Store in immutable audit log
    await this.auditStore.append({
      ...entry,
      id: generateUUID(),
      hash: this.computeHash(entry),
    });

    // Alert on suspicious activity
    if (this.isSuspicious(entry)) {
      await this.alertSecurityTeam(entry);
    }
  }

  private isSuspicious(entry: AuditEntry): boolean {
    return (
      entry.outcome === 'DENIED' ||
      entry.action === 'EXPORT' ||
      this.isAfterHoursAccess(entry) ||
      this.isUnusualVolume(entry)
    );
  }
}

// Data encryption configuration
const encryptionConfig = {
  // At-rest encryption
  atRest: {
    algorithm: 'AES-256-GCM',
    keyManagement: 'AWS KMS', // or HSM
    keyRotation: '90 days',
  },

  // In-transit encryption
  inTransit: {
    protocol: 'TLS 1.3',
    minVersion: 'TLS 1.2',
    cipherSuites: [
      'TLS_AES_256_GCM_SHA384',
      'TLS_CHACHA20_POLY1305_SHA256',
    ],
  },

  // Field-level encryption for highly sensitive fields
  fieldLevel: {
    enabled: true,
    fields: ['ssn', 'medical_record_number', 'diagnosis'],
    algorithm: 'AES-256-GCM',
  },
};