@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/au-vic-hra.js

@@ -0,0 +1,348 @@
+"use strict";
+/**
+ * VIC Health Records Act 2001 (HRA)
+ *
+ * Single-jurisdiction pack for Victoria's Health Records Act 2001. Disaggregated
+ * from the former au-state-health-privacy umbrella pack (X1-disaggregation, 2026-04-24).
+ *
+ * Administered by:
+ *   - Health Complaints Commissioner (HCC): complaints, investigations, enforcement
+ *     for health service providers in VIC.
+ *   - Office of the Victorian Information Commissioner (OVIC): oversight of VIC
+ *     public sector information privacy (separate from HCC's health-specific role).
+ *
+ * Scope: Private health service providers in Victoria. Public sector health agencies
+ * are covered under the VIC Privacy and Data Protection Act 2014 (PDPA) with
+ * distinct enforcement, but VIC HRA HPPs map to the same obligations.
+ *
+ * 11 Health Privacy Principles (HPPs):
+ *   HPP 1  Collection
+ *   HPP 2  Use and disclosure (HPP 2.2: research secondary use requires ethics
+ *          committee approval or de-identification -- distinct from federal APP 6)
+ *   HPP 3  Data quality
+ *   HPP 4  Data security
+ *   HPP 5  Openness
+ *   HPP 6  Access
+ *   HPP 7  Correction
+ *   HPP 8  Identifiers
+ *   HPP 9  Anonymity
+ *   HPP 10 Transnational data flows
+ *   HPP 11 Sensitive health information
+ *
+ * Retention (PROV guidance -- CITATION TO VERIFY current standards):
+ *   - Public hospitals: 7 years from last service entry.
+ *   - Mental health records: 25 years from creation [CITATION TO VERIFY].
+ *   - Minor patients: 10 years from age 18 (or 7 years from last service, whichever later).
+ *
+ * Civil penalties: AUD 10,000 per body corporate (VCAT civil penalty orders).
+ *
+ * [CITATION TO VERIFY]:
+ *   - VIC PROV current general health retention standards (7y from last service).
+ *   - VIC mental health 25-year retention -- current PROV standards.
+ *   - Whether NHMRC ethics approval satisfies VIC HPP 2.2 research provision for
+ *     cross-jurisdictional AI training cohorts alongside NSW HPP 14.
+ *
+ * Cross-pack interactions:
+ *   - au-vic-hra + au-privacy-act: VIC HRA overlays federal APPs. Federal NDB scheme
+ *     applies to all APP entities regardless of state act. Strictest-wins.
+ *   - au-vic-hra + au-nsw-hripa + au-act-hrpaa: Cross-state hospital networks must
+ *     satisfy all applicable jurisdiction packs. 25-year VIC mental health retention
+ *     is the strictest retention rule across the three jurisdictions.
+ *   - au-vic-hra + hipaa (cross-border): VIC hospital sending research data to US
+ *     partner -- VIC HRA governs AU-side; HIPAA de-identification safe harbor governs
+ *     US-side. VIC HPP 2.2 must be satisfied independently of HIPAA requirements.
+ *   - au-vic-hra + au-tga-saimd: TGA 10-year documentation retention overlaps VIC
+ *     general health retention (7y adult) and VIC mental health (25y). Safe approach:
+ *     10y from last service for general SaMD-associated VIC patient data; 25y for
+ *     mental health records.
+ *
+ * Authority: HCC (Health Complaints Commissioner) + OVIC
+ * Sovereignty: VIC State
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AU_VIC_HRA_PACK = exports.AU_VIC_HRA_CATEGORY_CLASSIFIERS = void 0;
+exports.AU_VIC_HRA_CATEGORY_CLASSIFIERS = {
+    VIC_HEALTH_INFORMATION: {
+        references: ['VIC HRA 2001 HPP 1 -- health information in Victoria; HCC + OVIC administered'],
+        classifier: (input) => {
+            if (/\b(?:vic(?:toria(?:n)?)?\s+(?:health\s+(?:information|record|data)|hra\b|health\s+records\s+act)|health\s+information.*(?:vic(?:toria)?|victoria)|(?:health\s+service|hospital).*vic.*(?:health\s+record|patient\s+data))/i.test(input))
+                return true;
+            // HCC-specific references
+            if (/\b(?:health\s+complaints\s+commissioner|hcc\s+vic|ovic|vic(?:torian)?\s+information\s+commissioner)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VIC_HEALTH_RESEARCH_USE: {
+        references: ['VIC HRA HPP 2.2 -- research provision; ethics committee approval or de-identification required'],
+        classifier: (input) => {
+            if (/\b(?:(?:ai\s+training|research|secondary\s+analysis).*vic(?:toria)?\s+(?:health|patient)\s+(?:data|record)|vic(?:toria)?\s+health.*(?:ai\s+training|research\s+use)|ethics.*vic\s+health.*(?:research|training)|vic.*hpp\s*2\.2)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VIC_MENTAL_HEALTH_RECORD: {
+        references: ['VIC HRA retention -- mental health records 25 years [CITATION TO VERIFY current PROV standards]'],
+        classifier: (input) => {
+            if (/\b(?:mental\s+health\s+(?:record|information|data).*(?:vic(?:toria)?|victoria)|vic.*mental\s+health\s+(?:record|retention|25\s+year))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VIC_HEALTH_MINOR_RECORD: {
+        references: ['VIC HRA retention -- minor patient records 10 years from age 18 [CITATION TO VERIFY PROV guidance]'],
+        classifier: (input) => {
+            // F-NEW-VERA-PACK-C7-07 (LOW): broadened minor-record classifier.
+            // Original regex required compound phrases like "minor vic health record"
+            // or "vic health paediatric record". Real clinical inputs rarely combine
+            // all three tokens in a single sentence. Broadened to fire on any VIC
+            // health context that includes any of: minor, paediatric, pediatric,
+            // child patient, under-18 framing (consistent with the finding requirement
+            // that paediatric|pediatric|child.*patient|under.*18 should fire).
+            if (/\b(?:minor.*vic.*health\s+record|vic.*health.*(?:paediatric|pediatric|child).*record|minor.*health.*(?:10\s+year|age\s+18).*vic)\b/i.test(input))
+                return true;
+            // Broadened patterns (C7-07):
+            if (/\b(?:paediatric|pediatric)\b.*\b(?:vic|victoria)\b/i.test(input))
+                return true;
+            if (/\b(?:vic|victoria)\b.*\b(?:paediatric|pediatric)\b/i.test(input))
+                return true;
+            if (/\bchild.*patient\b.*\b(?:vic|victoria|hcc|ovic|hra)\b/i.test(input))
+                return true;
+            if (/\b(?:vic|victoria|hcc|ovic|hra)\b.*\bchild.*patient\b/i.test(input))
+                return true;
+            if (/\bunder[\s-]*18\b.*\b(?:vic|victoria|hcc|ovic)\b/i.test(input))
+                return true;
+            if (/\b(?:vic|victoria|hcc|ovic)\b.*\bunder[\s-]*18\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.AU_VIC_HRA_PACK = {
+    categoryClassifiers: exports.AU_VIC_HRA_CATEGORY_CLASSIFIERS,
+    /**
+     * P3.5: VIC health information is subject-keyed by patient identifier.
+     * HPP 2.2 research provision enforcement, HPP 6/7 access/correction SLAs, and
+     * retention tracking (including 25-year mental health) all require per-patient
+     * identity correlation across VIC health service providers.
+     */
+    subjectKeyedCategories: [
+        'VIC_HEALTH_INFORMATION',
+        'VIC_HEALTH_RESEARCH_USE',
+        'VIC_MENTAL_HEALTH_RECORD',
+        'VIC_HEALTH_MINOR_RECORD',
+    ],
+    id: 'au-vic-hra',
+    name: 'VIC Health Records Act 2001 (HRA)',
+    version: '1.0.0',
+    description: 'VIC HRA 2001 compliance for AI systems processing health information in Victoria. ' +
+        'Enforces HPP 2.2 research secondary-use ethics gate (ethics committee approval or ' +
+        'de-identification required), 25-year mental health record retention [CITATION TO VERIFY], ' +
+        '30-day access/correction SLA (HPP 6/7), and HCC + OVIC dual-enforcer model. ' +
+        'Civil penalty: AUD 10,000 per body corporate (VCAT). ' +
+        '[CITATION TO VERIFY: PROV current general health retention (7y); VIC mental health 25y; ' +
+        'NHMRC ethics cross-jurisdictional sufficiency for VIC HPP 2.2.]',
+    authority: 'HCC (Health Complaints Commissioner) + OVIC (Office of the Victorian Information Commissioner)',
+    industries: [
+        'healthcare', 'hospitals', 'digital-health',
+        'allied-health', 'medical-research', 'aged-care',
+        'mental-health', 'health-it',
+    ],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'HPP 2.2 research ethics approval gate; 30-day access/correction SLA enforcement',
+            reference: 'VIC HRA HPP 2.2, HPP 6, HPP 7',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: '7-year general (adult) / 10-year-from-18 (minor) / 25-year (mental health) retention; tamper-evident audit trail',
+            reference: 'VIC PROV guidance [CITATION TO VERIFY]',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'HPP 4 data security; sensitive health info; AES-256 required',
+            reference: 'VIC HRA HPP 4; Privacy Act APP 11',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify VIC health information; detect research use, mental health records, minor records',
+            reference: 'VIC HRA HPP 1, HPP 2.2',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Research ethics confirmation gate (HPP 2.2); access/correction request workflow',
+            reference: 'VIC HRA HPP 2.2, HPP 6, HPP 7',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Per-patient rights tracking; access/correction SLA 30 days; 25-year mental health retention schedule',
+            reference: 'VIC HRA HPP 6, HPP 7; PROV guidance',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Research ethics event; breach notification (NDB + HCC/OVIC)',
+            reference: 'VIC HRA; Privacy Act NDB',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'HPP 1.3 collection notice requirement; HPP 2.3 use/disclosure notification; inform individuals of AI use in health decisions',
+            reference: 'VIC HRA HPP 1.3 (collection notice); HPP 2.3 (notification of use/disclosure)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            // F-NEW-VERA-PACK-C7-08 (2026-05-03): supply-chain was present in au-nsw-hripa but
+            // missing here. VIC health information processed by AI vendors requires vendor
+            // contracts mandating AU (Victorian) server location and VAGO/privacy-impact-assessment
+            // compliance. au-nsw-hripa already had this module; parity required.
+            reason: 'VIC health information vendors must be contractually bound to AU data residency; VIC Privacy Commissioner audit rights; HPP 4 security obligations extend to processors and sub-processors',
+            reference: 'VIC HRA HPP 4 (security obligations on processors); Privacy Act APP 8 (cross-border disclosure); AU data residency requirement for health information',
+        },
+    ],
+    moduleConfig: {
+        'data-classifier': {
+            enabledCategories: [
+                'VIC_HEALTH_INFORMATION',
+                'VIC_HEALTH_RESEARCH_USE',
+                'VIC_MENTAL_HEALTH_RECORD',
+                'VIC_HEALTH_MINOR_RECORD',
+            ],
+            vicResearchEthicsApprovalRequired: true,
+            healthRecordAccessSlaDays: 30,
+            healthCollectionNoticeActive: true,
+            healthCorrectionSlaDays: 30,
+            vicMentalHealthRetentionYears: 25,
+            vicMinorRetentionFromAge18Years: 10,
+        },
+        'governance-runtime': {
+            vicResearchEthicsApprovalRequired: true,
+            auStateHealthAccessResponseDays: 30,
+            healthCollectionNoticeActive: true,
+            auStateHealthCorrectionResponseDays: 30,
+        },
+        'session-persistence': {
+            accessRequestSlaDays: 30,
+            correctionRequestSlaDays: 30,
+            auStateHealthMentalHealthRetentionDays: 9125, // 25 years
+            auStateHealthMinorRetentionDays: 3650, // 10 years from age 18 (conservative)
+        },
+        'approval-queue': {
+            vicResearchEthicsConfirmationRequired: true,
+        },
+        'transparency-injector': {
+            auStateHealthCollectionNoticeEnabled: true,
+        },
+        'supply-chain': {
+            vendorServerLocationRequired: true,
+            auStateHealthVendorContractRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: [
+            'ETHICS-APPROVAL-FOR-RESEARCH',
+        ],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: [
+            'VIC_HEALTH_INFORMATION',
+            'VIC_HEALTH_RESEARCH_USE',
+            'VIC_MENTAL_HEALTH_RECORD',
+            'VIC_HEALTH_MINOR_RECORD',
+        ],
+        categoryActions: {
+            VIC_HEALTH_INFORMATION: 'REQUIRE_APPROVAL',
+            VIC_HEALTH_RESEARCH_USE: 'REQUIRE_APPROVAL',
+            // F-NEW-VERA-PACK-C7-06 fix: VIC_MENTAL_HEALTH_RECORD action raised from WARN to
+            // REQUIRE_APPROVAL. Mental health records under VIC Health Records Act 2001 carry
+            // a 25-year retention obligation (the strictest in the AU state health pack catalog).
+            // WARN is inadequate for a record class with a 25-year retention window and dual
+            // regulatory oversight (HCC + OVIC + OAIC). REQUIRE_APPROVAL requires human review
+            // before any processing, matching the sensitivity level of this record class.
+            VIC_MENTAL_HEALTH_RECORD: 'REQUIRE_APPROVAL',
+            VIC_HEALTH_MINOR_RECORD: 'WARN',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'CONFIDENTIAL',
+    },
+    retentionPolicy: {
+        sovereignty: ['AU-VIC'],
+        // Conservative cross-class floor: 10 years from last service.
+        // VIC mental health: 25 years [CITATION TO VERIFY current PROV standards].
+        // TGA SaMD overlap: 10y governs general SaMD-associated VIC patient data.
+        auditLogRetentionDays: 3650, // 10 years (conservative floor)
+        sessionRetentionDays: 3650,
+        // F-NEW-VERA-PACK-C7-06 fix: incidentRetentionDays raised from 1825 (5y, NDB-aligned)
+        // to 2555 (7y) as the minimum floor for general health records.
+        // Note: VIC mental health records have a 25-year retention obligation per PROV.
+        // 7y is the floor for incident records tied to general health records;
+        // mental health incident records effectively tie to the 25y window via the
+        // underlying record retention. 2555 = 7 * 365.
+        incidentRetentionDays: 2555, // 7 years (VIC Health Records Act 2001 minimum floor)
+        reference: 'VIC PROV: 7y adult [CTV] / 25y mental health [CTV] / 10y-from-18 minor. TGA overlap: 10y governs SaMD records. Conservative floor: 10y from last service. Incident records: 7y minimum (25y for mental health incidents per underlying record retention).',
+    },
+    incidentPolicy: {
+        notificationDeadlineHours: 720, // 30-day NDB baseline; HCC + OVIC also notified
+        reference: 'Federal Privacy Act Part IIIC NDB (30d baseline); HCC for serious health privacy; OVIC for information privacy',
+        requiredRecipients: ['vic-hcc', 'ovic', 'oaic'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'au-vic-hra-research-ethics',
+            description: 'AI training or secondary analysis on VIC health data requires ethics committee approval or de-identification (HPP 2.2)',
+            reference: 'VIC HRA HPP 2.2',
+            check: 'au_vic_hra_research_ethics_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'au-vic-hra-mental-health-retention',
+            description: 'VIC mental health records retained for 25 years [CITATION TO VERIFY current PROV standards]',
+            reference: 'VIC PROV guidance [CITATION TO VERIFY]',
+            check: 'au_vic_hra_mental_health_retention_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-vic-hra-access-30d',
+            description: 'VIC health record access requests actioned within 30 days (HPP 6)',
+            reference: 'VIC HRA HPP 6',
+            check: 'au_vic_hra_access_30d_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-vic-hra-collection-notice',
+            description: 'Collection notice presented before or at collection of VIC health information (HPP 1)',
+            reference: 'VIC HRA HPP 1',
+            check: 'au_vic_hra_collection_notice_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'au-vic-hra-correction-30d',
+            description: 'VIC health information correction requests actioned within 30 days (HPP 7)',
+            reference: 'VIC HRA HPP 7',
+            check: 'au_vic_hra_correction_30d_active',
+            failSeverity: 'MEDIUM',
+        },
+        {
+            id: 'au-vic-hra-minor-retention',
+            description: 'VIC minor patient health records retained minimum 10 years from age 18',
+            reference: 'VIC PROV guidance [CITATION TO VERIFY]',
+            check: 'au_vic_hra_minor_retention_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=au-vic-hra.js.map

package/dist/packs/au-vic-hra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"au-vic-hra.js","sourceRoot":"","sources":["../../src/packs/au-vic-hra.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;;;AAKU,QAAA,+BAA+B,GAAwB;IAClE,sBAAsB,EAAE;QACtB,UAAU,EAAE,CAAC,+EAA+E,CAAC;QAC7F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,4NAA4N,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1P,0BAA0B;YAC1B,IAAI,wGAAwG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtI,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,gGAAgG,CAAC;QAC9G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qOAAqO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnQ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,wBAAwB,EAAE;QACxB,UAAU,EAAE,CAAC,iGAAiG,CAAC;QAC/G,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,0IAA0I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,uBAAuB,EAAE;QACvB,UAAU,EAAE,CAAC,oGAAoG,CAAC;QAClH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,kEAAkE;YAClE,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,2EAA2E;YAC3E,mEAAmE;YACnE,IAAI,qIAAqI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnK,8BAA8B;YAC9B,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,IAAI,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtF,IAAI,wDAAwD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtF,IAAI,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjF,IAAI,mDAAmD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,eAAe,GAGxB;IACF,mBAAmB,EAAE,uCAA+B;IACpD;;;;;OAKG;IACH,sBAAsB,EAAE;QACtB,wBAAwB;QACxB,yBAAyB;QACzB,0BAA0B;QAC1B,yBAAyB;KAC1B;IAED,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,mCAAmC;IACzC,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,oFAAoF;QACpF,oFAAoF;QACpF,4FAA4F;QAC5F,8EAA8E;QAC9E,uDAAuD;QACvD,0FAA0F;QAC1F,iEAAiE;IACnE,SAAS,EAAE,gGAAgG;IAC3G,UAAU,EAAE;QACV,YAAY,EAAE,WAAW,EAAE,gBAAgB;QAC3C,eAAe,EAAE,kBAAkB,EAAE,WAAW;QAChD,eAAe,EAAE,WAAW;KAC7B;IAED,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iFAAiF;YACzF,SAAS,EAAE,+BAA+B;SAC3C;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kHAAkH;YAC1H,SAAS,EAAE,wCAAwC;SACpD;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8DAA8D;YACtE,SAAS,EAAE,mCAAmC;SAC/C;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4FAA4F;YACpG,SAAS,EAAE,wBAAwB;SACpC;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iFAAiF;YACzF,SAAS,EAAE,+BAA+B;SAC3C;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,sGAAsG;YAC9G,SAAS,EAAE,qCAAqC;SACjD;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6DAA6D;YACrE,SAAS,EAAE,0BAA0B;SACtC;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8HAA8H;YACtI,SAAS,EAAE,+EAA+E;SAC3F;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,mFAAmF;YACnF,+EAA+E;YAC/E,wFAAwF;YACxF,qEAAqE;YACrE,MAAM,EAAE,4LAA4L;YACpM,SAAS,EAAE,uJAAuJ;SACnK;KACF;IAED,YAAY,EAAE;QACZ,iBAAiB,EAAE;YACjB,iBAAiB,EAAE;gBACjB,wBAAwB;gBACxB,yBAAyB;gBACzB,0BAA0B;gBAC1B,yBAAyB;aAC1B;YACD,iCAAiC,EAAE,IAAI;YACvC,yBAAyB,EAAE,EAAE;YAC7B,4BAA4B,EAAE,IAAI;YAClC,uBAAuB,EAAE,EAAE;YAC3B,6BAA6B,EAAE,EAAE;YACjC,+BAA+B,EAAE,EAAE;SACpC;QACD,oBAAoB,EAAE;YACpB,iCAAiC,EAAE,IAAI;YACvC,+BAA+B,EAAE,EAAE;YACnC,4BAA4B,EAAE,IAAI;YAClC,mCAAmC,EAAE,EAAE;SACxC;QACD,qBAAqB,EAAE;YACrB,oBAAoB,EAAE,EAAE;YACxB,wBAAwB,EAAE,EAAE;YAC5B,sCAAsC,EAAE,IAAI,EAAE,WAAW;YACzD,+BAA+B,EAAE,IAAI,EAAS,sCAAsC;SACrF;QACD,gBAAgB,EAAE;YAChB,qCAAqC,EAAE,IAAI;SAC5C;QACD,uBAAuB,EAAE;YACvB,oCAAoC,EAAE,IAAI;SAC3C;QACD,cAAc,EAAE;YACd,4BAA4B,EAAE,IAAI;YAClC,mCAAmC,EAAE,IAAI;SAC1C;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,EAAE;QACpB,oBAAoB,EAAE;YACpB,8BAA8B;SAC/B;QACD,YAAY,EAAE,EAAE;KACjB;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,wBAAwB;YACxB,yBAAyB;YACzB,0BAA0B;YAC1B,yBAAyB;SAC1B;QACD,eAAe,EAAE;YACf,sBAAsB,EAAE,kBAAkB;YAC1C,uBAAuB,EAAE,kBAAkB;YAC3C,iFAAiF;YACjF,kFAAkF;YAClF,sFAAsF;YACtF,iFAAiF;YACjF,mFAAmF;YACnF,8EAA8E;YAC9E,wBAAwB,EAAE,kBAAkB;YAC5C,uBAAuB,EAAE,MAAM;SAChC;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,SAAS;QAC7B,qBAAqB,EAAE,cAAc;KACtC;IAED,eAAe,EAAE;QACf,WAAW,EAAE,CAAC,QAAQ,CAAC;QACvB,8DAA8D;QAC9D,2EAA2E;QAC3E,0EAA0E;QAC1E,qBAAqB,EAAE,IAAI,EAAG,gCAAgC;QAC9D,oBAAoB,EAAE,IAAI;QAC1B,sFAAsF;QACtF,gEAAgE;QAChE,gFAAgF;QAChF,uEAAuE;QACvE,2EAA2E;QAC3E,+CAA+C;QAC/C,qBAAqB,EAAE,IAAI,EAAG,sDAAsD;QACpF,SAAS,EAAE,2PAA2P;KACvQ;IAED,cAAc,EAAE;QACd,yBAAyB,EAAE,GAAG,EAAE,gDAAgD;QAChF,SAAS,EAAE,gHAAgH;QAC3H,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/C,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,wHAAwH;YACrI,SAAS,EAAE,iBAAiB;YAC5B,KAAK,EAAE,mCAAmC;YAC1C,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,WAAW,EAAE,6FAA6F;YAC1G,SAAS,EAAE,wCAAwC;YACnD,KAAK,EAAE,2CAA2C;YAClD,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EAAE,mEAAmE;YAChF,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,8BAA8B;YACrC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,8BAA8B;YAClC,WAAW,EAAE,uFAAuF;YACpG,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,qCAAqC;YAC5C,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,2BAA2B;YAC/B,WAAW,EAAE,4EAA4E;YACzF,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE,kCAAkC;YACzC,YAAY,EAAE,QAAQ;SACvB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,wEAAwE;YACrF,SAAS,EAAE,wCAAwC;YACnD,KAAK,EAAE,mCAAmC;YAC1C,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}

package/dist/packs/bipa.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Illinois BIPA Compliance Pack
+ *
+ * Illinois Biometric Information Privacy Act (740 ILCS 14/) with 2024
+ * SB 2979 amendment (per-person violation counting). Applies to any
+ * entity collecting biometric identifiers or biometric information
+ * from Illinois residents.
+ *
+ * Statutory damages:
+ *   - $1,000 per negligent violation
+ *   - $5,000 per intentional / reckless violation
+ *   - Post-SB 2979: per-person (not per-scan) aggregation
+ *
+ * Rosenbach v. Six Flags (2019 Ill.): plaintiff does not need actual
+ * damages; statutory damages alone suffice.
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * BIPA (Illinois Biometric Information Privacy Act, 740 ILCS 14) category classifiers.
+ * BIPA restricts collection, use, and storage of biometric identifiers and information.
+ */
+export declare const BIPA_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const BIPA_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+    subjectKeyedCategories: string[];
+};
+//# sourceMappingURL=bipa.d.ts.map

package/dist/packs/bipa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bipa.d.ts","sourceRoot":"","sources":["../../src/packs/bipa.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAG/E;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBA+BvC,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAC;IAAC,sBAAsB,EAAE,MAAM,EAAE,CAAA;CAmNpH,CAAC"}

package/dist/packs/bipa.js

@@ -0,0 +1,271 @@
+"use strict";
+/**
+ * Illinois BIPA Compliance Pack
+ *
+ * Illinois Biometric Information Privacy Act (740 ILCS 14/) with 2024
+ * SB 2979 amendment (per-person violation counting). Applies to any
+ * entity collecting biometric identifiers or biometric information
+ * from Illinois residents.
+ *
+ * Statutory damages:
+ *   - $1,000 per negligent violation
+ *   - $5,000 per intentional / reckless violation
+ *   - Post-SB 2979: per-person (not per-scan) aggregation
+ *
+ * Rosenbach v. Six Flags (2019 Ill.): plaintiff does not need actual
+ * damages; statutory damages alone suffice.
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BIPA_PACK = exports.BIPA_CATEGORY_CLASSIFIERS = void 0;
+const _base_classifiers_1 = require("./_base-classifiers");
+/**
+ * BIPA (Illinois Biometric Information Privacy Act, 740 ILCS 14) category classifiers.
+ * BIPA restricts collection, use, and storage of biometric identifiers and information.
+ */
+exports.BIPA_CATEGORY_CLASSIFIERS = {
+    BIOMETRIC_IDENTIFIER: {
+        references: ['740 ILCS 14/10 -- biometric identifier definition'],
+        classifier: (input) => {
+            if (/\b(?:fingerprint|retinal scan|iris scan|voiceprint|hand geometry|face geometry|biometric[_\s]id)\b/i.test(input))
+                return true;
+            if (/\bbiometric[_-]?(?:identifier|template|hash|data)[:\s=]*\S+/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    BIOMETRIC_INFORMATION: {
+        references: ['740 ILCS 14/10 -- biometric information definition'],
+        classifier: (input) => {
+            if (/\b(?:facial recognition|voice recognition|biometric\s+(?:data|information|record|scan|match))\b/i.test(input))
+                return true;
+            if (/\b(?:face\s+(?:scan|template|vector|embedding|print)|fingerprint\s+hash)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['740 ILCS 14/10 -- personally identifying information associated with biometrics'],
+        classifier: _base_classifiers_1.sharedPiiClassifier,
+    },
+    CREDENTIALS: {
+        references: ['BIPA §15(e) -- reasonable standard of care; credential protection'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.BIPA_PACK = {
+    categoryClassifiers: exports.BIPA_CATEGORY_CLASSIFIERS,
+    /** P3.5: Biometric identifiers and information are inherently subject-keyed per BIPA 740 ILCS 14. */
+    subjectKeyedCategories: ['BIOMETRIC_IDENTIFIER', 'BIOMETRIC_INFORMATION'],
+    id: 'bipa',
+    name: 'BIPA',
+    version: '1.0.0',
+    description: 'Illinois Biometric Information Privacy Act compliance with 2024 SB 2979 amendment. Written consent, public policy, no sale, retention / destruction schedule, private right of action with statutory damages.',
+    authority: 'Illinois Courts (private right of action)',
+    industries: ['any-collecting-biometric-il', 'retail-facial-recognition', 'access-control-biometric', 'timeclock-biometric', 'fintech-voiceprint', 'healthcare-biometric', 'hr-technology'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Biometric-collection gate: block without per-subject written consent',
+            reference: '740 ILCS 14/15(b)',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident record of consent capture + destruction + disclosure events',
+            reference: '740 ILCS 14/15(a), (d)',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Detect BIOMETRIC_IDENTIFIER + BIOMETRIC_INFORMATION',
+            reference: '740 ILCS 14/10 (definitions)',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Per-subject retention schedule enforcement; consent record continuity',
+            reference: '740 ILCS 14/15(a), (b)',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Vendor terms prohibit sale / lease / trade / profit on biometric data',
+            reference: '740 ILCS 14/15(c)',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Disclosure requests require subject consent verification',
+            reference: '740 ILCS 14/15(d)',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Written public policy + retention schedule attestation',
+            reference: '740 ILCS 14/15(a)',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'Reasonable care standard requires encryption at rest + in transit',
+            reference: '740 ILCS 14/15(e)',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Per-person violation aggregation (post-SB 2979)',
+            reference: '740 ILCS 14/20 (as amended)',
+        },
+        {
+            name: 'data-subject-rights',
+            required: true,
+            reason: 'Subject deletion requests processed per destruction schedule',
+            reference: 'Rosenbach v. Six Flags 2019; §15(a)',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            writtenConsentRequired: true,
+            extraterritorialIlSubjectCheck: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['BIOMETRIC_IDENTIFIER', 'BIOMETRIC_INFORMATION', 'PII', 'CREDENTIALS'],
+            biometricAction: 'BLOCK_WITHOUT_CONSENT',
+        },
+        'session-persistence': {
+            perSubjectRetentionScheduleRequired: true,
+            destructionOnScheduleMaturityRequired: true,
+        },
+        'supply-chain': {
+            biometricSaleProhibited: true,
+            biometricLeaseProhibited: true,
+            biometricTradeProhibited: true,
+            biometricProfitProhibited: true,
+        },
+        'approval-queue': {
+            disclosureRequiresSubjectConsent: true,
+        },
+        'attestation-manager': {
+            publicPolicyRequired: true,
+            retentionScheduleRequired: true,
+            destructionGuidelinesRequired: true,
+        },
+        'event-bus': {
+            perPersonViolationAggregation: true,
+        },
+        'data-subject-rights': {
+            biometricDeletionSupported: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: [],
+        requiredCapabilities: ['BIOMETRIC-NO-SALE', 'BIOMETRIC-NO-TRAINING'],
+        blockReasons: {},
+    },
+    dataPolicy: {
+        scanCategories: ['BIOMETRIC_IDENTIFIER', 'BIOMETRIC_INFORMATION', 'PII', 'CREDENTIALS'],
+        categoryActions: {
+            BIOMETRIC_IDENTIFIER: 'BLOCK',
+            BIOMETRIC_INFORMATION: 'BLOCK',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        sovereignty: ['US-IL'],
+        // 5 years aligned with statute of limitations + class-action tail
+        auditLogRetentionDays: 1825,
+        sessionRetentionDays: 1825,
+        incidentRetentionDays: 1825,
+        reference: 'Illinois statute of limitations + BIPA class-action tail',
+    },
+    incidentPolicy: {
+        // 7-day external notification to affected subjects (Pax1 default; no statutory deadline)
+        notificationDeadlineHours: 168,
+        reference: 'No statutory deadline. Pax1 default 7-day external + same-day internal to privacy counsel.',
+        requiredRecipients: ['affected-subjects', 'privacy-counsel', 'risk-management'],
+        formalNotificationRequired: false,
+    },
+    validators: [
+        {
+            id: 'bipa-consent',
+            description: 'Written consent per subject before biometric collection',
+            reference: '740 ILCS 14/15(b)',
+            check: 'bipa_consent_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'bipa-policy',
+            description: 'Publicly available written policy with retention + destruction guidelines',
+            reference: '740 ILCS 14/15(a)',
+            check: 'bipa_policy_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'bipa-no-sale',
+            description: 'Biometric data not sold, leased, traded, or profited from',
+            reference: '740 ILCS 14/15(c)',
+            check: 'bipa_no_sale_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'bipa-disclosure-consent',
+            description: 'Disclosure requires subject consent',
+            reference: '740 ILCS 14/15(d)',
+            check: 'bipa_disclosure_consent_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'bipa-retention-schedule',
+            description: 'Per-subject retention schedule enforced with destruction on maturity',
+            reference: '740 ILCS 14/15(a)',
+            check: 'bipa_retention_schedule_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'bipa-reasonable-care',
+            description: 'Reasonable care standard: encryption + access controls + vendor due diligence',
+            reference: '740 ILCS 14/15(e)',
+            check: 'encryption_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'bipa-per-person-aggregation',
+            description: 'Violations aggregated per-person (post-SB 2979)',
+            reference: '740 ILCS 14/20 (2024 amendment)',
+            check: 'bipa_per_person_active',
+            failSeverity: 'MEDIUM',
+        },
+        {
+            id: 'bipa-extraterritorial',
+            description: 'Extraterritorial check: IL resident flag evaluated on collection',
+            reference: '740 ILCS 14 (extraterritorial scope)',
+            check: 'bipa_extraterritorial_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'bipa-deletion-supported',
+            description: 'Subject deletion requests supported via DSR workflow',
+            reference: 'Rosenbach v. Six Flags 2019',
+            check: 'bipa_deletion_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=bipa.js.map