@connexum/ai-governance 1.0.0-beta.11

package/dist/packs/nhs-dcb0129-dcb0160.js

@@ -0,0 +1,473 @@
+"use strict";
+/**
+ * NHS Clinical Safety Standards: DCB0129 + DCB0160 Compliance Pack
+ *
+ * Standards:
+ *   - DCB0129 (Clinical Risk Management: its Application in the Manufacture
+ *     of Health IT Systems) — applies to the MANUFACTURER (the customer
+ *     building the AI agent / health IT system).
+ *   - DCB0160 (Clinical Risk Management: its Application in the Deployment
+ *     and Use of Health IT Systems) — applies to the DEPLOYER (the NHS
+ *     trust or health organisation running the AI agent in production).
+ *
+ * Both standards are mandatory for any clinical IT system used in the NHS,
+ * issued under the Health and Social Care Act 2012 s250. They are NOT
+ * optional and they are NOT alternatives — a clinical IT system used in
+ * the NHS must comply with BOTH (manufacturer evidence flows to deployer,
+ * deployer adds operational evidence on top).
+ *
+ * Jurisdiction: GB (United Kingdom — England-led; equivalent practice
+ *   followed in Scotland / Wales / Northern Ireland)
+ * Authority: NHS England (publishes both standards); previously NHS Digital
+ * Regulator overlap: MHRA (when the system is also a SaMD under UKCA);
+ *   ICO (when personal data is processed); CQC (well-led KLOE evidence)
+ *
+ * Why this pack:
+ *   - Required for any clinical IT system in the NHS — including AI agents
+ *     issuing or supporting clinical recommendations, triage, scheduling,
+ *     summarisation of clinical content, or any decision affecting patient
+ *     care.
+ *   - The Clinical Safety Officer (CSO) role is a contractual gate: a
+ *     suitably qualified clinician must be named for the manufacturer side
+ *     AND for each deployer organisation.
+ *   - Unblocks Pack 4 (MHRA UK SaMD) per F-NEW-TIER-10-UK-WAVE1-ROADMAP —
+ *     MHRA SaMD evidence inherits the DCB0129 clinical-safety-case spine.
+ *   - Depends on Pack 5 (NHS DSPT, PR #395) for the NHS-data classification
+ *     substrate (NHS Number, SNOMED-CT, ICD-10).
+ *
+ * Key obligations encoded in this pack:
+ *   1. Clinical Safety Officer (CSO) named for both manufacturer and each
+ *      deployer; sign-off captured on the Clinical Safety Case Report.
+ *   2. Hazard log: every clinical hazard identified, scored (likelihood ×
+ *      severity → risk level), mitigated, residual-risk assessed, and
+ *      reviewed at every release / configuration change.
+ *   3. Clinical Safety Case Report (CSCR) — the single document that
+ *      assembles hazards, mitigations, residual risk, deployment context,
+ *      training and operational instructions, and the CSO sign-off. CSCR
+ *      is the contractual artefact a deploying NHS organisation requires
+ *      before procuring or going live with a clinical IT system.
+ *   4. Change-control gate: any change to a clinical IT system requires
+ *      hazard-log re-review and CSCR update before deployment.
+ *   5. Incident response: clinical safety incidents reported to the CSO,
+ *      logged in the hazard log, and where harm reached or could reach a
+ *      patient, escalated to the deploying organisation's Patient Safety
+ *      Incident Response Framework (PSIRF) and (if applicable) MHRA Yellow
+ *      Card / Field Safety Notice.
+ *   6. Manufacturer-deployer evidence handoff: the manufacturer's CSCR is
+ *      the deployer's input; the deployer's DCB0160 evidence layers on
+ *      operational context (local config, training records, integration
+ *      hazards).
+ *   7. AI-specific overlays: model-version logging, drift monitoring as a
+ *      named hazard, prompt / output sample retention for forensic review.
+ *
+ * Out of scope:
+ *   - MHRA SaMD UKCA marking (separate pack: forthcoming Wave 1 Pack 4)
+ *   - NHS DSPT data security baseline (separate pack: nhs-dspt PR #395)
+ *   - Cyber Essentials technical-control evidence (separate pack:
+ *     cyber-essentials PR #397)
+ *   - UK GDPR personal-data handling (separate pack: uk-gdpr)
+ *
+ * @connexum/ai-governance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NHS_CLINICAL_SAFETY_PACK = exports.NHS_CLINICAL_SAFETY_CATEGORY_CLASSIFIERS = void 0;
+/**
+ * DCB0129/DCB0160 category classifiers.
+ *
+ * Pack scope is clinical-safety evidence: hazards, mitigations, CSCR
+ * artefacts, CSO sign-off records, change-control reviews, and AI-model
+ * audit metadata. Personal-data classification is delegated to nhs-dspt
+ * and uk-gdpr packs which a clinical-IT customer must run alongside.
+ */
+exports.NHS_CLINICAL_SAFETY_CATEGORY_CLASSIFIERS = {
+    HAZARD_LOG_ENTRY: {
+        references: [
+            'DCB0129 §5 hazard identification + analysis; DCB0160 §5 deployment hazard log',
+        ],
+        classifier: (input) => {
+            if (/\b(?:hazard\s+(?:log|entry|id|register)|haz[\s-]?\d{2,5})\b/i.test(input))
+                return true;
+            if (/\b(?:clinical\s+hazard|patient[\s-]?safety\s+hazard|hazard\s+(?:identification|analysis|review))\b/i.test(input))
+                return true;
+            if (/\b(?:likelihood\s*[x×]\s*severity|risk\s+(?:matrix|score|rating)\s+(?:catastrophic|major|moderate|minor|negligible))\b/i.test(input))
+                return true;
+            if (/\b(?:residual\s+risk|mitigation\s+(?:control|action|measure))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CSCR_DOCUMENT: {
+        references: [
+            'DCB0129 §6 Clinical Safety Case Report; DCB0160 §6 Deployment Clinical Safety Case Report',
+        ],
+        classifier: (input) => {
+            if (/\b(?:clinical\s+safety\s+case\s+(?:report|cscr)|cscr\s+v\d|safety\s+case\s+(?:document|file))\b/i.test(input))
+                return true;
+            if (/\b(?:dcb\s*0129\s+(?:report|evidence)|dcb\s*0160\s+(?:report|evidence)|dcb0129|dcb0160)\b/i.test(input))
+                return true;
+            if (/\b(?:nhs\s+england\s+clinical\s+risk\s+management|clinical\s+risk\s+management\s+system)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CSO_SIGNOFF: {
+        references: [
+            'DCB0129 §4.1 Clinical Safety Officer competence; DCB0160 §4.1 deployer CSO',
+        ],
+        classifier: (input) => {
+            if (/\b(?:clinical\s+safety\s+officer|cso)\s+(?:sign[\s-]?off|approval|attestation|appointment|delegation)\b/i.test(input))
+                return true;
+            if (/\b(?:cso\s+(?:gmc|nmc|hcpc)|cso\s+name|appointed\s+cso|named\s+clinical\s+safety\s+officer)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CLINICAL_INCIDENT: {
+        references: [
+            'DCB0129/0160 §7 incident management; PSIRF (Patient Safety Incident Response Framework) 2022',
+        ],
+        classifier: (input) => {
+            if (/\b(?:patient[\s-]?safety[\s-]?incident|psi\s+report|psirf|sirio?-)\b/i.test(input))
+                return true;
+            if (/\b(?:clinical\s+incident|never\s+event|sui\s+(?:incident|investigation)|moderate\s+harm|severe\s+harm)\b/i.test(input))
+                return true;
+            if (/\b(?:yellow\s+card|field\s+safety\s+notice|fsn|mhra\s+report)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    AI_MODEL_AUDIT: {
+        references: [
+            'DCB0129 AI overlay: model version, drift monitoring; NHS England AI Lab guidance',
+        ],
+        classifier: (input) => {
+            if (/\b(?:model\s+version|model[\s-]?id|prompt\s+template\s+v\d|inference\s+(?:trace|transcript))\b/i.test(input))
+                return true;
+            if (/\b(?:drift\s+(?:detected|alert|threshold)|distribution\s+shift|recalibration\s+required)\b/i.test(input))
+                return true;
+            if (/\b(?:ai\s+model\s+(?:lifecycle|deployment\s+log)|inference\s+log\s+retained)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CLINICAL_RECORD: {
+        references: [
+            'NHS Records Management Code of Practice 2021 (overlap with nhs-dspt pack); DCB0129/0160 evidence may include patient-identifying material',
+        ],
+        classifier: (input) => {
+            if (/\b(?:patient\s+(?:record|notes|encounter|consultation))\b/i.test(input))
+                return true;
+            if (/\b(?:clinical\s+(?:record|notes|history|finding|impression))\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['Cross-pack secrets safety; CSO sign-off artefacts must not embed credentials'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+exports.NHS_CLINICAL_SAFETY_PACK = {
+    categoryClassifiers: exports.NHS_CLINICAL_SAFETY_CATEGORY_CLASSIFIERS,
+    id: 'nhs-clinical-safety',
+    aliases: [
+        'dcb0129',
+        'dcb0160',
+        'dcb-0129',
+        'dcb-0160',
+        'nhs-dcb0129-dcb0160',
+        'clinical-safety-case',
+        'cscr',
+        'nhs-clinical-risk-management',
+    ],
+    name: 'NHS Clinical Safety (DCB0129 manufacturer + DCB0160 deployer)',
+    version: '1.0.0',
+    description: 'NHS England clinical safety standards DCB0129 (manufacturer / health IT vendor) and DCB0160 (deployer / NHS trust) covering hazard log, Clinical Safety Case Report (CSCR), Clinical Safety Officer (CSO) named-role sign-off gate, change-control re-review, and clinical incident escalation per PSIRF + MHRA Yellow Card / FSN. Mandatory for any clinical IT system used in the NHS, including AI agents issuing or supporting clinical recommendations. AI overlay: model-version logging, drift monitoring as a named hazard, inference trace retention. Depends on NHS DSPT (Pack 5) for NHS-data classification substrate; unblocks MHRA SaMD UKCA (Pack 4) per the UK Wave 1 roadmap.',
+    authority: 'NHS England (publisher of DCB0129 + DCB0160) + Clinical Safety Officer (named role) + MHRA (for SaMD-overlapping systems) + ICO (UK GDPR overlay) + CQC (well-led KLOE evidence)',
+    industries: ['healthcare', 'pharma', 'public-sector', 'digital-health', 'clinical-research', 'medical-devices'],
+    requiredModules: [
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'CSO designation + Clinical Safety Case Report (CSCR) registration; per-version CSCR + hazard-log attestation; manufacturer-deployer evidence chain.',
+            reference: 'DCB0129 §4.1 CSO competence + §6 CSCR; DCB0160 §4.1 deployer CSO + §6 deployment CSCR',
+        },
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Clinical-decision gate: AI agent must not issue clinical recommendation without an active CSCR + hazard log covering the recommendation type. Default-deny on uncovered clinical paths.',
+            reference: 'DCB0129 §5 hazard identification; DCB0160 §5 deployment hazard log',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'CSO sign-off gate (T2 named-clinician review) on (a) CSCR initial issue and revisions, (b) every change-control event affecting clinical paths, (c) clinical incident classifications above LOW severity.',
+            reference: 'DCB0129 §6.4 CSCR sign-off; DCB0160 §7 incident management',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident audit chain for hazard-log entries, CSO sign-off events, CSCR version history, change-control reviews, and clinical incident records — required as evidence for CQC inspection and PSIRF investigations.',
+            reference: 'DCB0129/0160 §7 evidence retention; PSIRF 2022 evidence requirements',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'Clinical incident detection, model-drift alerts, and Yellow Card / FSN escalation routing; CSO notification on every uncovered hazard path.',
+            reference: 'DCB0129/0160 §7 incident management; MHRA Yellow Card scheme; PSIRF',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Inference-trace retention for forensic review of clinical-decision incidents; hazard-log retention beyond product lifecycle (DCB0129 retains for product life + 10 years).',
+            reference: 'DCB0129 §8 evidence retention — product lifecycle + 10 years',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Surface hazard-log entries, CSCR documents, CSO sign-off, clinical incidents, AI-model audit records, and clinical-record context for evidence collection.',
+            reference: 'DCB0129/0160 evidence categorisation',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'Per-deployment training-records attestation (DCB0160 §6 deployer must show clinicians trained on the system before go-live).',
+            reference: 'DCB0160 §6 training records evidence',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'Manufacturer-to-deployer evidence handoff: vendor CSCR + DCB0129 evidence flows to each deploying NHS trust which then layers DCB0160 deployer evidence on top.',
+            reference: 'DCB0129/0160 manufacturer-deployer interface; NHS Digital procurement guidance',
+        },
+        {
+            name: 'transparency-injector',
+            required: true,
+            reason: 'Patient-facing AI use disclosure where the AI agent participates in the patient-care pathway; uncertainty / confidence display for clinical-decision support outputs.',
+            reference: 'DCB0129/0160 patient-facing transparency overlay; NHS England AI Lab guidance',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'CSCR evidence chain encrypted; clinical incident records encrypted; consistent with DSPT and UK GDPR Art. 32 expectations.',
+            reference: 'NHS DSPT Section 7 secure systems; UK GDPR Art. 32(1)(a)',
+        },
+    ],
+    moduleConfig: {
+        'attestation-manager': {
+            csoDesignationRequired: true,
+            cscrRegistrationRequired: true,
+            hazardLogPerVersionRequired: true,
+            manufacturerDeployerEvidenceChainRequired: true,
+            trainingRecordsRequired: true,
+            retentionYearsAfterEol: 10,
+        },
+        'governance-runtime': {
+            clinicalDecisionGateRequired: true,
+            defaultDenyOnUncoveredClinicalPath: true,
+            modelVersionLoggingRequired: true,
+            driftMonitoringHazardRequired: true,
+        },
+        'approval-queue': {
+            csoSignOffOnCscrRequired: true,
+            csoSignOffOnChangeControlRequired: true,
+            csoSignOffOnIncidentClassificationRequired: true,
+            reviewTier: 'T2',
+            reviewerCompetence: 'CLINICAL_SAFETY_OFFICER',
+        },
+        'event-bus': {
+            clinicalIncidentRoutingRequired: true,
+            modelDriftAlertsRequired: true,
+            mhraYellowCardEscalationRequired: true,
+            fieldSafetyNoticeWorkflowRequired: true,
+        },
+        'session-persistence': {
+            retentionDaysAfterProductEol: 3650, // 10 years post-EoL
+            inferenceTraceRetentionRequired: true,
+        },
+        'data-classifier': {
+            enabledCategories: [
+                'HAZARD_LOG_ENTRY',
+                'CSCR_DOCUMENT',
+                'CSO_SIGNOFF',
+                'CLINICAL_INCIDENT',
+                'AI_MODEL_AUDIT',
+                'CLINICAL_RECORD',
+                'CREDENTIALS',
+            ],
+            hazardLogAction: 'WARN',
+            cscrDocumentAction: 'WARN',
+            csoSignoffAction: 'WARN',
+            clinicalIncidentAction: 'WARN',
+            aiModelAuditAction: 'WARN',
+            credentialsAction: 'BLOCK',
+        },
+        'supply-chain': {
+            vendorCscrEvidenceRequired: true,
+            deployerEvidenceLayerRequired: true,
+        },
+        'transparency-injector': {
+            patientFacingAiDisclosureRequired: true,
+            confidenceDisplayRequired: true,
+        },
+        'encryption-layer': {
+            algorithm: 'aes-256-gcm',
+            encryptionRequiredForClinicalEvidence: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['DATA-RESIDENCY-UK-OR-EU', 'PROCESSOR-CONTRACT', 'NHS-DSPT-SUBSCRIBED', 'CLINICAL-SAFETY-EVIDENCE-EXPORT'],
+        blockReasons: {
+            deepseek: 'PRC jurisdiction. Clinical-safety evidence chain must be UK-resident; no UK adequacy for PRC. Incompatible with DCB0129/0160 evidence retention requirements.',
+            baidu: 'PRC jurisdiction. NHS clinical-safety evidence cannot route through PRC infrastructure.',
+            alibaba: 'PRC jurisdiction. NHS clinical-safety evidence cannot route through PRC infrastructure.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: [
+            'HAZARD_LOG_ENTRY',
+            'CSCR_DOCUMENT',
+            'CSO_SIGNOFF',
+            'CLINICAL_INCIDENT',
+            'AI_MODEL_AUDIT',
+            'CLINICAL_RECORD',
+            'CREDENTIALS',
+        ],
+        categoryActions: {
+            HAZARD_LOG_ENTRY: 'WARN',
+            CSCR_DOCUMENT: 'WARN',
+            CSO_SIGNOFF: 'WARN',
+            CLINICAL_INCIDENT: 'WARN',
+            AI_MODEL_AUDIT: 'WARN',
+            CLINICAL_RECORD: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        // DCB0129 §8: clinical-safety evidence retained for product lifecycle
+        // plus 10 years. We use the 10-year post-EoL window as the policy
+        // floor and require legal-hold support for active investigations.
+        auditLogRetentionDays: 3650, // 10 years
+        sessionRetentionDays: 3650,
+        incidentRetentionDays: 3650,
+        reference: 'DCB0129 §8 evidence retention (product lifecycle + 10 years); NHS Records Management Code of Practice 2021 alignment',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['gb'],
+    },
+    incidentPolicy: {
+        // Clinical-safety incident notification windows are not statutorily
+        // fixed in DCB0129/0160 themselves — they delegate to PSIRF and MHRA
+        // (Yellow Card for adverse events, FSN for field safety). 72 hours
+        // remains the practical baseline aligning with UK GDPR + NHS England.
+        notificationDeadlineHours: 72,
+        reference: 'DCB0129/0160 §7 incident management; PSIRF 2022; MHRA Yellow Card scheme; MHRA Field Safety Notice (FSN) workflow',
+        requiredRecipients: [
+            'clinical-safety-officer',
+            'caldicott-guardian',
+            'senior-information-risk-owner',
+            'mhra-yellow-card-scheme',
+            'deploying-organisation-cso',
+        ],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'nhs-clinical-safety-cso-named',
+            description: 'Clinical Safety Officer named (manufacturer side) + per-deployment CSO named (deployer side); credentials (GMC / NMC / HCPC) recorded.',
+            reference: 'DCB0129 §4.1 CSO competence; DCB0160 §4.1 deployer CSO',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nhs-clinical-safety-cscr-current',
+            description: 'Clinical Safety Case Report (CSCR) registered, current (no overdue change-control review), and signed off by named CSO.',
+            reference: 'DCB0129 §6 CSCR; DCB0160 §6 deployment CSCR',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nhs-clinical-safety-hazard-log-active',
+            description: 'Hazard log active with at least one entry per identified clinical hazard; likelihood × severity score recorded; mitigation + residual risk captured.',
+            reference: 'DCB0129 §5 hazard identification; DCB0160 §5 deployment hazard log',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nhs-clinical-safety-clinical-decision-gate',
+            description: 'Default-deny on AI clinical-decision actions where no covering hazard-log entry + CSCR section exists. CSO sign-off gate engaged on uncovered clinical paths.',
+            reference: 'DCB0129 §5 hazard identification; default-deny clinical-safety overlay',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nhs-clinical-safety-change-control',
+            description: 'Every change to a clinical IT system triggers hazard-log re-review and CSCR update before deployment; CSO sign-off gates the rollout.',
+            reference: 'DCB0129/0160 §6 change control',
+            check: 'approval_queue_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'nhs-clinical-safety-incident-routing',
+            description: 'Clinical incidents route to CSO + Caldicott Guardian + SIRO; PSIRF investigation pathway available; MHRA Yellow Card + FSN escalation wired.',
+            reference: 'DCB0129/0160 §7 incident management; PSIRF 2022; MHRA Yellow Card',
+            check: 'monitoring_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nhs-clinical-safety-model-version-logging',
+            description: 'AI model version + prompt template version + inference-trace ID recorded on every clinical recommendation for forensic review.',
+            reference: 'DCB0129 AI overlay; NHS England AI Lab guidance',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nhs-clinical-safety-drift-monitoring',
+            description: 'AI model drift monitoring active and named as a hazard in the hazard log; recalibration / retraining workflow defined.',
+            reference: 'DCB0129 AI overlay; NHS England AI lifecycle guidance',
+            check: 'monitoring_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nhs-clinical-safety-evidence-retention',
+            description: 'Clinical-safety evidence retained for product lifecycle plus 10 years; legal-hold support active for incident investigations.',
+            reference: 'DCB0129 §8 evidence retention',
+            check: 'retention_policy_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nhs-clinical-safety-deployer-training',
+            description: 'Deployer-side training records captured before go-live; clinicians attested as trained on the clinical IT system.',
+            reference: 'DCB0160 §6 training records',
+            check: 'attestation_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nhs-clinical-safety-manufacturer-deployer-handoff',
+            description: 'Manufacturer CSCR + DCB0129 evidence package available to deploying organisation; deployer DCB0160 evidence layered on top.',
+            reference: 'DCB0129/0160 manufacturer-deployer interface',
+            check: 'subservice_registry_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'nhs-clinical-safety-encryption',
+            description: 'Clinical-safety evidence chain encrypted at rest and in transit; consistent with NHS DSPT Section 7 and UK GDPR Art. 32.',
+            reference: 'NHS DSPT Section 7; UK GDPR Art. 32(1)(a)',
+            check: 'encryption_active',
+            failSeverity: 'MEDIUM',
+        },
+    ],
+};
+//# sourceMappingURL=nhs-dcb0129-dcb0160.js.map

package/dist/packs/nhs-dcb0129-dcb0160.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhs-dcb0129-dcb0160.js","sourceRoot":"","sources":["../../src/packs/nhs-dcb0129-dcb0160.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;;;AAKH;;;;;;;GAOG;AACU,QAAA,wCAAwC,GAAwB;IAC3E,gBAAgB,EAAE;QAChB,UAAU,EAAE;YACV,+EAA+E;SAChF;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,8DAA8D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5F,IAAI,qGAAqG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnI,IAAI,yHAAyH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvJ,IAAI,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,aAAa,EAAE;QACb,UAAU,EAAE;YACV,2FAA2F;SAC5F;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,kGAAkG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChI,IAAI,4FAA4F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1H,IAAI,6FAA6F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE;YACV,4EAA4E;SAC7E;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,0GAA0G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxI,IAAI,gGAAgG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9H,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,iBAAiB,EAAE;QACjB,UAAU,EAAE;YACV,8FAA8F;SAC/F;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,IAAI,2GAA2G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzI,IAAI,kEAAkE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,cAAc,EAAE;QACd,UAAU,EAAE;YACV,kFAAkF;SACnF;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,iGAAiG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/H,IAAI,6FAA6F,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3H,IAAI,iFAAiF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/G,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,eAAe,EAAE;QACf,UAAU,EAAE;YACV,2IAA2I;SAC5I;QACD,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,4DAA4D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1F,IAAI,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/F,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,8EAA8E,CAAC;QAC5F,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEW,QAAA,wBAAwB,GAAkE;IACrG,mBAAmB,EAAE,gDAAwC;IAC7D,EAAE,EAAE,qBAAqB;IACzB,OAAO,EAAE;QACP,SAAS;QACT,SAAS;QACT,UAAU;QACV,UAAU;QACV,qBAAqB;QACrB,sBAAsB;QACtB,MAAM;QACN,8BAA8B;KAC/B;IACD,IAAI,EAAE,+DAA+D;IACrE,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,gqBAAgqB;IAClqB,SAAS,EAAE,kLAAkL;IAC7L,UAAU,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;IAE/G,eAAe,EAAE;QACf;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,qJAAqJ;YAC7J,SAAS,EAAE,uFAAuF;SACnG;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yLAAyL;YACjM,SAAS,EAAE,oEAAoE;SAChF;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2MAA2M;YACnN,SAAS,EAAE,4DAA4D;SACxE;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,yNAAyN;YACjO,SAAS,EAAE,sEAAsE;SAClF;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6IAA6I;YACrJ,SAAS,EAAE,qEAAqE;SACjF;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4KAA4K;YACpL,SAAS,EAAE,8DAA8D;SAC1E;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4JAA4J;YACpK,SAAS,EAAE,sCAAsC;SAClD;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8HAA8H;YACtI,SAAS,EAAE,sCAAsC;SAClD;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iKAAiK;YACzK,SAAS,EAAE,gFAAgF;SAC5F;QACD;YACE,IAAI,EAAE,uBAAuB;YAC7B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uKAAuK;YAC/K,SAAS,EAAE,+EAA+E;SAC3F;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,4HAA4H;YACpI,SAAS,EAAE,0DAA0D;SACtE;KACF;IAED,YAAY,EAAE;QACZ,qBAAqB,EAAE;YACrB,sBAAsB,EAAE,IAAI;YAC5B,wBAAwB,EAAE,IAAI;YAC9B,2BAA2B,EAAE,IAAI;YACjC,yCAAyC,EAAE,IAAI;YAC/C,uBAAuB,EAAE,IAAI;YAC7B,sBAAsB,EAAE,EAAE;SAC3B;QACD,oBAAoB,EAAE;YACpB,4BAA4B,EAAE,IAAI;YAClC,kCAAkC,EAAE,IAAI;YACxC,2BAA2B,EAAE,IAAI;YACjC,6BAA6B,EAAE,IAAI;SACpC;QACD,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;YAC9B,iCAAiC,EAAE,IAAI;YACvC,0CAA0C,EAAE,IAAI;YAChD,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,yBAAyB;SAC9C;QACD,WAAW,EAAE;YACX,+BAA+B,EAAE,IAAI;YACrC,wBAAwB,EAAE,IAAI;YAC9B,gCAAgC,EAAE,IAAI;YACtC,iCAAiC,EAAE,IAAI;SACxC;QACD,qBAAqB,EAAE;YACrB,4BAA4B,EAAE,IAAI,EAAE,oBAAoB;YACxD,+BAA+B,EAAE,IAAI;SACtC;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE;gBACjB,kBAAkB;gBAClB,eAAe;gBACf,aAAa;gBACb,mBAAmB;gBACnB,gBAAgB;gBAChB,iBAAiB;gBACjB,aAAa;aACd;YACD,eAAe,EAAE,MAAM;YACvB,kBAAkB,EAAE,MAAM;YAC1B,gBAAgB,EAAE,MAAM;YACxB,sBAAsB,EAAE,MAAM;YAC9B,kBAAkB,EAAE,MAAM;YAC1B,iBAAiB,EAAE,OAAO;SAC3B;QACD,cAAc,EAAE;YACd,0BAA0B,EAAE,IAAI;YAChC,6BAA6B,EAAE,IAAI;SACpC;QACD,uBAAuB,EAAE;YACvB,iCAAiC,EAAE,IAAI;YACvC,yBAAyB,EAAE,IAAI;SAChC;QACD,kBAAkB,EAAE;YAClB,SAAS,EAAE,aAAa;YACxB,qCAAqC,EAAE,IAAI;SAC5C;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,yBAAyB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,iCAAiC,CAAC;QACjI,YAAY,EAAE;YACZ,QAAQ,EAAE,+JAA+J;YACzK,KAAK,EAAE,yFAAyF;YAChG,OAAO,EAAE,yFAAyF;SACnG;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE;YACd,kBAAkB;YAClB,eAAe;YACf,aAAa;YACb,mBAAmB;YACnB,gBAAgB;YAChB,iBAAiB;YACjB,aAAa;SACd;QACD,eAAe,EAAE;YACf,gBAAgB,EAAE,MAAM;YACxB,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,MAAM;YACnB,iBAAiB,EAAE,MAAM;YACzB,cAAc,EAAE,MAAM;YACtB,eAAe,EAAE,MAAM;YACvB,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,sEAAsE;QACtE,kEAAkE;QAClE,kEAAkE;QAClE,qBAAqB,EAAE,IAAI,EAAE,WAAW;QACxC,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EACP,sHAAsH;QACxH,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,CAAC;KACpB;IAED,cAAc,EAAE;QACd,oEAAoE;QACpE,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EACP,mHAAmH;QACrH,kBAAkB,EAAE;YAClB,yBAAyB;YACzB,oBAAoB;YACpB,+BAA+B;YAC/B,yBAAyB;YACzB,4BAA4B;SAC7B;QACD,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,+BAA+B;YACnC,WAAW,EACT,wIAAwI;YAC1I,SAAS,EAAE,wDAAwD;YACnE,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,kCAAkC;YACtC,WAAW,EACT,yHAAyH;YAC3H,SAAS,EAAE,6CAA6C;YACxD,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,uCAAuC;YAC3C,WAAW,EACT,sJAAsJ;YACxJ,SAAS,EAAE,oEAAoE;YAC/E,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,4CAA4C;YAChD,WAAW,EACT,+JAA+J;YACjK,SAAS,EAAE,wEAAwE;YACnF,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,oCAAoC;YACxC,WAAW,EACT,uIAAuI;YACzI,SAAS,EAAE,gCAAgC;YAC3C,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,sCAAsC;YAC1C,WAAW,EACT,8IAA8I;YAChJ,SAAS,EAAE,mEAAmE;YAC9E,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,2CAA2C;YAC/C,WAAW,EACT,gIAAgI;YAClI,SAAS,EAAE,iDAAiD;YAC5D,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,sCAAsC;YAC1C,WAAW,EACT,wHAAwH;YAC1H,SAAS,EAAE,uDAAuD;YAClE,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,wCAAwC;YAC5C,WAAW,EACT,+HAA+H;YACjI,SAAS,EAAE,+BAA+B;YAC1C,KAAK,EAAE,yBAAyB;YAChC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,uCAAuC;YAC3C,WAAW,EACT,mHAAmH;YACrH,SAAS,EAAE,6BAA6B;YACxC,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,mDAAmD;YACvD,WAAW,EACT,6HAA6H;YAC/H,SAAS,EAAE,8CAA8C;YACzD,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,gCAAgC;YACpC,WAAW,EACT,0HAA0H;YAC5H,SAAS,EAAE,2CAA2C;YACtD,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,QAAQ;SACvB;KACF;CACF,CAAC"}

package/dist/packs/nhs-dspt.d.ts

@@ -0,0 +1,83 @@
+/**
+ * NHS Data Security and Protection Toolkit (DSPT) Compliance Pack
+ *
+ * Regulation:
+ *   NHS England / NHS Digital — Data Security and Protection Toolkit
+ *   National Data Guardian (NDG) ten data security standards
+ *   NHS Digital Care Records Service operating model
+ *   Caldicott Principles (eight, 2020 revision)
+ *   Common Law Duty of Confidentiality (clinical record context)
+ *
+ * Jurisdiction: GB — England (devolved equivalents Scotland / Wales /
+ *   Northern Ireland have parallel toolkits but DSPT is the England standard
+ *   used as the de-facto UK NHS baseline by suppliers).
+ *
+ * Regulator: NHS England (DSPT submission portal; assertion-based
+ *   self-assessment with mandatory third-party assurance for "Standards Met"
+ *   status). The Information Commissioner's Office (ICO) reviews the
+ *   underlying personal-data handling under UK GDPR. Care Quality Commission
+ *   (CQC) inspectors use DSPT submission status as a regulated-activity
+ *   benchmark.
+ *
+ * Required of:
+ *   - Every NHS organisation
+ *   - Every supplier processing NHS clinical data, NHS numbers, or
+ *     NHS-network-connected health data ("NHS data partner") — including
+ *     AI agents that touch any NHS-tagged signal
+ *
+ * Key obligations encoded in this pack:
+ *   1. NHS Number detection + minimum-necessary handling (NDG #1, #4)
+ *   2. SNOMED-CT + ICD-10 clinical-code detection (clinical context flag)
+ *   3. 8-year retention for adult clinical records (Records Management
+ *      Code of Practice 2021); 25 years post-care for paediatric records;
+ *      30 years for maternity records.
+ *   4. Cross-NHS-trust transfer human-in-the-loop gate (NDG #4 lawful basis)
+ *   5. Annual data security training assertion (NDG #3)
+ *   6. Continuity / cyber-attack response posture (NDG #6, #7, #9)
+ *   7. Supplier contractual flow-down (NDG #10)
+ *   8. Caldicott Guardian sign-off for non-routine clinical data sharing
+ *
+ * Out of scope for this pack (handled by sibling packs when added):
+ *   - DCB0129 / DCB0160 clinical safety case (separate pack)
+ *   - MHRA SaMD UKCA marking (separate pack)
+ *   - Cyber Essentials / CE+ technical control evidence (separate pack)
+ *
+ * Distinction from UK GDPR pack:
+ *   UK GDPR governs personal-data handling at the Article-based level. NHS
+ *   DSPT layers on top with NHS-specific data classes (NHS Number, clinical
+ *   codes), NHS-specific retention windows, NHS-specific incident reporting
+ *   (CareCERT / NHS England), and the Caldicott Guardian role. A processor
+ *   handling NHS data needs BOTH packs active.
+ *
+ * Status: ACTIVE (Wave 1 Pack 5 of TIER 10-UK; first dependency unblocking
+ *   DCB0129 / DTAC / MHRA packs per F-NEW-TIER-10-UK-WAVE1-ROADMAP).
+ *
+ * @connexum/ai-governance
+ */
+import { CompliancePack } from './index';
+import { CategoryClassifiers } from '../classification/pack-driven-classifier';
+/**
+ * NHS DSPT category classifiers.
+ *
+ * NHS_NUMBER: 10 digits with mod-11 check digit. We accept the surface form
+ * (10 contiguous digits OR 3-3-4 spaced grouping) without verifying the
+ * check digit at the classifier layer; downstream redactor can validate.
+ *
+ * SNOMED_CT: numeric concept IDs (6 to 18 digits). Surface form is highly
+ * ambiguous on its own, so we require a co-located clinical context cue
+ * ("snomed", "concept id", "code") to avoid false-positives on any long
+ * integer.
+ *
+ * ICD_10: A-Z + 2 digits + optional `.X` extension (e.g. `J45.901`, `R51`).
+ * Stricter pattern than the SNOMED catch-anything-numeric approach.
+ *
+ * CLINICAL_RECORD: free-text clinical-record indicators ("patient",
+ * "diagnosis", "encounter", "consultation", "discharge summary"). Flagged
+ * because NHS records are subject to the 8-year retention and Caldicott
+ * sign-off rules even when no NHS Number is present.
+ */
+export declare const NHS_DSPT_CATEGORY_CLASSIFIERS: CategoryClassifiers;
+export declare const NHS_DSPT_PACK: CompliancePack & {
+    categoryClassifiers: CategoryClassifiers;
+};
+//# sourceMappingURL=nhs-dspt.d.ts.map

package/dist/packs/nhs-dspt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nhs-dspt.d.ts","sourceRoot":"","sources":["../../src/packs/nhs-dspt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,EAAE,mBAoE3C,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,cAAc,GAAG;IAAE,mBAAmB,EAAE,mBAAmB,CAAA;CA4RtF,CAAC"}