@erosolaraijs/cure 1.0.0

package/dist/compliance/hipaa.js

@@ -0,0 +1,929 @@
+/**
+ * HIPAA Compliance Layer
+ *
+ * Provides comprehensive HIPAA compliance features:
+ * - Audit logging (access, modification, disclosure)
+ * - Patient consent management
+ * - Data encryption (at rest and in transit)
+ * - Access control and authentication
+ * - Break-the-glass emergency access
+ * - Minimum necessary standard enforcement
+ * - Business Associate Agreement tracking
+ *
+ * IMPORTANT: This module implements the technical safeguards required by HIPAA.
+ * Administrative and physical safeguards must be implemented organizationally.
+ */
+import { createHash, createCipheriv, createDecipheriv, randomBytes, scrypt } from 'crypto';
+import { EventEmitter } from 'events';
+// ═══════════════════════════════════════════════════════════════════════════════
+// HIPAA COMPLIANCE SERVICE
+// ═══════════════════════════════════════════════════════════════════════════════
+export class HIPAAComplianceService extends EventEmitter {
+    auditStore = [];
+    consents = new Map();
+    accessPolicies = [];
+    encryptionKeys = new Map();
+    activeKeyId;
+    config;
+    lastEntryHash;
+    constructor(config) {
+        super();
+        this.config = {
+            encryption: {
+                algorithm: 'aes-256-gcm',
+                keyDerivation: 'scrypt',
+                keyRotationDays: 90,
+                fieldLevelEncryption: true,
+                encryptedFields: ['ssn', 'dob', 'address', 'phone', 'genomics', 'mentalHealth'],
+                ...config?.encryption
+            },
+            masking: {
+                ssnPattern: 'last4',
+                dobPattern: 'age-only',
+                phonePattern: 'last4',
+                addressPattern: 'city-state',
+                mrnPattern: 'full',
+                genomicPattern: 'summary',
+                ...config?.masking
+            },
+            auditRetentionDays: config?.auditRetentionDays || 2190, // 6 years per HIPAA
+            emergencyAccessEnabled: config?.emergencyAccessEnabled ?? true
+        };
+        // Initialize encryption key
+        this.activeKeyId = this.generateKeyId();
+        this.initializeEncryptionKey();
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // AUDIT LOGGING
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Log an audit event
+     */
+    async logAuditEvent(entry) {
+        const id = this.generateAuditId();
+        const timestamp = new Date();
+        // Create the entry
+        const fullEntry = {
+            id,
+            timestamp,
+            ...entry,
+            previousEntryHash: this.lastEntryHash
+        };
+        // Calculate hash for tamper detection
+        fullEntry.entryHash = this.calculateEntryHash(fullEntry);
+        this.lastEntryHash = fullEntry.entryHash;
+        // Store the entry
+        this.auditStore.push(fullEntry);
+        // Emit event for external handlers
+        this.emit('audit-event', fullEntry);
+        // Check for suspicious patterns
+        await this.detectSuspiciousActivity(fullEntry);
+        return id;
+    }
+    /**
+     * Log PHI access event
+     */
+    async logPHIAccess(params) {
+        return this.logAuditEvent({
+            eventType: params.emergencyAccess ? 'emergency-access' : 'access',
+            action: params.action,
+            outcome: 'success',
+            actor: {
+                userId: params.userId,
+                userName: params.userName,
+                role: params.role,
+                ipAddress: params.ipAddress
+            },
+            resource: {
+                type: params.resourceType,
+                id: params.resourceId,
+                patientId: params.patientId
+            },
+            details: {
+                fieldsAccessed: params.fieldsAccessed,
+                reason: params.reason,
+                emergencyAccess: params.emergencyAccess,
+                consentId: params.consentId
+            },
+            security: {
+                authMethod: 'mfa', // Assuming MFA for PHI access
+                encryptionUsed: true,
+                integrityVerified: true,
+                accessLevel: params.emergencyAccess ? 'emergency' : 'normal'
+            }
+        });
+    }
+    /**
+     * Log PHI modification event
+     */
+    async logPHIModification(params) {
+        return this.logAuditEvent({
+            eventType: 'modification',
+            action: params.action,
+            outcome: 'success',
+            actor: {
+                userId: params.userId,
+                role: params.role,
+                ipAddress: params.ipAddress
+            },
+            resource: {
+                type: params.resourceType,
+                id: params.resourceId,
+                patientId: params.patientId
+            },
+            details: {
+                fieldsModified: params.fieldsModified,
+                previousValues: params.previousValues,
+                newValues: params.newValues,
+                reason: params.reason
+            },
+            security: {
+                authMethod: 'mfa',
+                encryptionUsed: true,
+                integrityVerified: true,
+                accessLevel: 'normal'
+            }
+        });
+    }
+    /**
+     * Log authentication event
+     */
+    async logAuthentication(params) {
+        return this.logAuditEvent({
+            eventType: 'authentication',
+            action: params.action,
+            outcome: params.success ? 'success' : 'failure',
+            actor: {
+                userId: params.userId,
+                role: 'unknown',
+                ipAddress: params.ipAddress
+            },
+            resource: {
+                type: 'system'
+            },
+            details: params.failureReason ? { reason: params.failureReason } : undefined,
+            security: {
+                authMethod: params.authMethod,
+                encryptionUsed: true,
+                integrityVerified: true,
+                accessLevel: 'normal'
+            }
+        });
+    }
+    /**
+     * Query audit logs
+     */
+    queryAuditLogs(params) {
+        let filtered = [...this.auditStore];
+        if (params.startDate) {
+            filtered = filtered.filter(e => e.timestamp >= params.startDate);
+        }
+        if (params.endDate) {
+            filtered = filtered.filter(e => e.timestamp <= params.endDate);
+        }
+        if (params.patientId) {
+            filtered = filtered.filter(e => e.resource.patientId === params.patientId);
+        }
+        if (params.userId) {
+            filtered = filtered.filter(e => e.actor.userId === params.userId);
+        }
+        if (params.eventType) {
+            filtered = filtered.filter(e => e.eventType === params.eventType);
+        }
+        if (params.action) {
+            filtered = filtered.filter(e => e.action === params.action);
+        }
+        if (params.outcome) {
+            filtered = filtered.filter(e => e.outcome === params.outcome);
+        }
+        // Sort by timestamp descending
+        filtered.sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime());
+        const total = filtered.length;
+        const offset = params.offset || 0;
+        const limit = params.limit || 100;
+        return {
+            entries: filtered.slice(offset, offset + limit),
+            total
+        };
+    }
+    /**
+     * Get accounting of disclosures for a patient (HIPAA requirement)
+     */
+    getAccountingOfDisclosures(patientId, startDate, endDate) {
+        return this.auditStore.filter(entry => entry.resource.patientId === patientId &&
+            entry.eventType === 'disclosure' &&
+            (!startDate || entry.timestamp >= startDate) &&
+            (!endDate || entry.timestamp <= endDate)).sort((a, b) => b.timestamp.getTime() - a.timestamp.getTime());
+    }
+    /**
+     * Verify audit log integrity
+     */
+    verifyAuditLogIntegrity() {
+        const errors = [];
+        for (let i = 0; i < this.auditStore.length; i++) {
+            const entry = this.auditStore[i];
+            // Verify hash
+            const { entryHash: _hash, ...entryWithoutHash } = entry;
+            const calculatedHash = this.calculateEntryHash(entryWithoutHash);
+            if (calculatedHash !== entry.entryHash) {
+                errors.push(`Entry ${entry.id} has been tampered with (hash mismatch)`);
+            }
+            // Verify chain
+            if (i > 0 && entry.previousEntryHash !== this.auditStore[i - 1].entryHash) {
+                errors.push(`Entry ${entry.id} has broken chain link`);
+            }
+        }
+        return {
+            valid: errors.length === 0,
+            errors
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // CONSENT MANAGEMENT
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Record a patient consent
+     */
+    async recordConsent(consent) {
+        const id = this.generateConsentId();
+        const now = new Date();
+        const fullConsent = {
+            id,
+            ...consent,
+            audit: {
+                createdAt: now,
+                createdBy: consent.capture.method === 'electronic' ? 'system' : 'staff'
+            }
+        };
+        // Store consent
+        const patientConsents = this.consents.get(consent.patientId) || [];
+        patientConsents.push(fullConsent);
+        this.consents.set(consent.patientId, patientConsents);
+        // Log the consent capture
+        await this.logAuditEvent({
+            eventType: 'consent-change',
+            action: 'consent-obtained',
+            outcome: 'success',
+            actor: {
+                userId: fullConsent.audit.createdBy,
+                role: 'system',
+                ipAddress: consent.capture.ipAddress || 'unknown'
+            },
+            resource: {
+                type: 'patient',
+                patientId: consent.patientId,
+                description: `${consent.consentType} consent`
+            },
+            details: {
+                consentId: id
+            },
+            security: {
+                authMethod: 'password',
+                encryptionUsed: true,
+                integrityVerified: true,
+                accessLevel: 'normal'
+            }
+        });
+        this.emit('consent-recorded', fullConsent);
+        return id;
+    }
+    /**
+     * Revoke a patient consent
+     */
+    async revokeConsent(consentId, revokedBy, reason) {
+        for (const [patientId, consents] of this.consents) {
+            const consent = consents.find(c => c.id === consentId);
+            if (consent) {
+                consent.status = 'revoked';
+                consent.audit.revokedAt = new Date();
+                consent.audit.revokedBy = revokedBy;
+                consent.audit.revocationReason = reason;
+                // Log the revocation
+                await this.logAuditEvent({
+                    eventType: 'consent-change',
+                    action: 'consent-revoked',
+                    outcome: 'success',
+                    actor: {
+                        userId: revokedBy,
+                        role: 'patient',
+                        ipAddress: 'unknown'
+                    },
+                    resource: {
+                        type: 'patient',
+                        patientId,
+                        description: `${consent.consentType} consent revoked`
+                    },
+                    details: {
+                        consentId,
+                        reason
+                    },
+                    security: {
+                        authMethod: 'password',
+                        encryptionUsed: true,
+                        integrityVerified: true,
+                        accessLevel: 'normal'
+                    }
+                });
+                this.emit('consent-revoked', consent);
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Check if a patient has consented to a specific use
+     */
+    checkConsent(patientId, purpose, dataCategory) {
+        const patientConsents = this.consents.get(patientId) || [];
+        // Find active consent that covers the purpose
+        const validConsent = patientConsents.find(c => c.status === 'active' &&
+            c.scope.purposes.includes(purpose) &&
+            (!dataCategory || c.scope.dataCategories.includes(dataCategory)) &&
+            (!c.validity.expirationDate || c.validity.expirationDate > new Date()));
+        if (validConsent) {
+            return {
+                hasConsent: true,
+                consentId: validConsent.id,
+                restrictions: validConsent.scope.excludedData
+            };
+        }
+        // Check if TPO (Treatment, Payment, Operations) - may not require explicit consent
+        if (['treatment', 'payment', 'healthcare-operations'].includes(purpose)) {
+            // TPO typically covered by Notice of Privacy Practices
+            return {
+                hasConsent: true,
+                restrictions: []
+            };
+        }
+        return {
+            hasConsent: false
+        };
+    }
+    /**
+     * Get all consents for a patient
+     */
+    getPatientConsents(patientId) {
+        return this.consents.get(patientId) || [];
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // ACCESS CONTROL
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Add an access policy
+     */
+    addAccessPolicy(policy) {
+        const id = this.generatePolicyId();
+        const fullPolicy = { id, ...policy };
+        this.accessPolicies.push(fullPolicy);
+        this.accessPolicies.sort((a, b) => b.priority - a.priority);
+        return id;
+    }
+    /**
+     * Check if access should be allowed
+     */
+    checkAccess(request) {
+        const time = request.time || new Date();
+        // Emergency access bypass (break-the-glass)
+        if (request.emergencyAccess && this.config.emergencyAccessEnabled) {
+            return {
+                allowed: true,
+                reason: 'Emergency access granted (break-the-glass)',
+                conditions: ['Must document emergency reason', 'Subject to post-hoc review'],
+                auditRequired: true
+            };
+        }
+        // Check consent if accessing patient data
+        if (request.patientId && request.purpose) {
+            const consentCheck = this.checkConsent(request.patientId, request.purpose, request.dataCategory);
+            if (!consentCheck.hasConsent) {
+                return {
+                    allowed: false,
+                    reason: `No consent for ${request.purpose} purpose`,
+                    auditRequired: true
+                };
+            }
+        }
+        // Evaluate policies in priority order
+        for (const policy of this.accessPolicies) {
+            if (!policy.enabled)
+                continue;
+            // Check if policy applies to this subject
+            const subjectMatch = (!policy.subjects.roles || policy.subjects.roles.includes(request.role)) &&
+                (!policy.subjects.users || policy.subjects.users.includes(request.userId)) &&
+                (!policy.subjects.organizations || policy.subjects.organizations.includes(request.organization || ''));
+            if (!subjectMatch)
+                continue;
+            // Check if policy applies to this resource
+            const resourceMatch = (!policy.resources.types || policy.resources.types.includes(request.resourceType)) &&
+                (!policy.resources.patientIds || !request.patientId || policy.resources.patientIds.includes(request.patientId)) &&
+                (!policy.resources.dataCategories || !request.dataCategory || policy.resources.dataCategories.includes(request.dataCategory));
+            if (!resourceMatch)
+                continue;
+            // Check if action is permitted
+            if (!policy.permissions.actions.includes(request.action)) {
+                continue;
+            }
+            // Evaluate conditions
+            const conditionResults = this.evaluateConditions(policy.permissions.conditions || [], request, time);
+            if (conditionResults.allMet) {
+                return {
+                    allowed: true,
+                    policy: policy.id,
+                    reason: `Access granted by policy: ${policy.name}`,
+                    conditions: conditionResults.messages,
+                    auditRequired: true
+                };
+            }
+            else if (conditionResults.requiresElevation) {
+                return {
+                    allowed: false,
+                    policy: policy.id,
+                    reason: 'Access requires additional verification',
+                    requiresElevation: true,
+                    conditions: conditionResults.messages,
+                    auditRequired: true
+                };
+            }
+        }
+        // Default deny
+        return {
+            allowed: false,
+            reason: 'No matching policy found - access denied by default',
+            auditRequired: true
+        };
+    }
+    evaluateConditions(conditions, request, time) {
+        const messages = [];
+        let requiresElevation = false;
+        for (const condition of conditions) {
+            switch (condition.type) {
+                case 'time-of-day':
+                    const hour = time.getHours();
+                    const startHour = condition.parameters.startHour || 0;
+                    const endHour = condition.parameters.endHour || 24;
+                    if (hour < startHour || hour >= endHour) {
+                        messages.push(`Access outside permitted hours (${startHour}:00 - ${endHour}:00)`);
+                        return { allMet: false, requiresElevation: false, messages };
+                    }
+                    break;
+                case 'ip-range':
+                    // Simplified IP check - would need proper CIDR matching in production
+                    const allowedRanges = condition.parameters.ranges;
+                    if (request.ipAddress && !allowedRanges.some(r => request.ipAddress.startsWith(r))) {
+                        messages.push('Access from unauthorized network location');
+                        return { allMet: false, requiresElevation: false, messages };
+                    }
+                    break;
+                case 'mfa-required':
+                    messages.push('Multi-factor authentication required');
+                    requiresElevation = true;
+                    break;
+                case 'purpose':
+                    const allowedPurposes = condition.parameters.purposes;
+                    if (!request.purpose || !allowedPurposes.includes(request.purpose)) {
+                        messages.push(`Purpose '${request.purpose}' not permitted`);
+                        return { allMet: false, requiresElevation: false, messages };
+                    }
+                    break;
+                case 'emergency-only':
+                    if (!request.emergencyAccess) {
+                        messages.push('Access restricted to emergency situations');
+                        return { allMet: false, requiresElevation: false, messages };
+                    }
+                    break;
+            }
+        }
+        return {
+            allMet: !requiresElevation,
+            requiresElevation,
+            messages
+        };
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // ENCRYPTION
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Encrypt sensitive data
+     */
+    async encryptData(data, context) {
+        const keyEntry = this.encryptionKeys.get(this.activeKeyId);
+        if (!keyEntry) {
+            throw new Error('No active encryption key');
+        }
+        const iv = randomBytes(16);
+        const algorithm = this.config.encryption.algorithm;
+        if (algorithm === 'aes-256-gcm') {
+            const cipher = createCipheriv('aes-256-gcm', keyEntry.key, iv);
+            if (context) {
+                cipher.setAAD(Buffer.from(context));
+            }
+            const dataBuffer = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+            const encrypted = Buffer.concat([cipher.update(dataBuffer), cipher.final()]);
+            const authTag = cipher.getAuthTag();
+            return {
+                ciphertext: encrypted.toString('base64'),
+                iv: iv.toString('base64'),
+                authTag: authTag.toString('base64'),
+                keyId: this.activeKeyId,
+                algorithm,
+                encryptedAt: new Date()
+            };
+        }
+        else {
+            // AES-256-CBC fallback
+            const cipher = createCipheriv('aes-256-cbc', keyEntry.key, iv);
+            const dataBuffer = typeof data === 'string' ? Buffer.from(data, 'utf8') : data;
+            const encrypted = Buffer.concat([cipher.update(dataBuffer), cipher.final()]);
+            return {
+                ciphertext: encrypted.toString('base64'),
+                iv: iv.toString('base64'),
+                keyId: this.activeKeyId,
+                algorithm: 'aes-256-cbc',
+                encryptedAt: new Date()
+            };
+        }
+    }
+    /**
+     * Decrypt data
+     */
+    async decryptData(encrypted, context) {
+        const keyEntry = this.encryptionKeys.get(encrypted.keyId);
+        if (!keyEntry) {
+            throw new Error(`Encryption key ${encrypted.keyId} not found`);
+        }
+        const iv = Buffer.from(encrypted.iv, 'base64');
+        const ciphertext = Buffer.from(encrypted.ciphertext, 'base64');
+        if (encrypted.algorithm === 'aes-256-gcm') {
+            const decipher = createDecipheriv('aes-256-gcm', keyEntry.key, iv);
+            if (encrypted.authTag) {
+                decipher.setAuthTag(Buffer.from(encrypted.authTag, 'base64'));
+            }
+            if (context) {
+                decipher.setAAD(Buffer.from(context));
+            }
+            return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        }
+        else {
+            const decipher = createDecipheriv('aes-256-cbc', keyEntry.key, iv);
+            return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        }
+    }
+    /**
+     * Encrypt specific PHI fields in an object
+     */
+    async encryptPHI(data) {
+        const encryptedFields = {};
+        const result = { ...data };
+        for (const field of this.config.encryption.encryptedFields || []) {
+            if (data[field] !== undefined) {
+                encryptedFields[field] = await this.encryptData(JSON.stringify(data[field]), field);
+                result[field] = '[ENCRYPTED]';
+            }
+        }
+        result._encrypted = encryptedFields;
+        return result;
+    }
+    /**
+     * Decrypt PHI fields in an object
+     */
+    async decryptPHI(data) {
+        if (!data._encrypted)
+            return data;
+        const result = { ...data };
+        for (const [field, encrypted] of Object.entries(data._encrypted)) {
+            const decrypted = await this.decryptData(encrypted, field);
+            result[field] = JSON.parse(decrypted.toString('utf8'));
+        }
+        delete result._encrypted;
+        return result;
+    }
+    /**
+     * Rotate encryption keys
+     */
+    async rotateEncryptionKey() {
+        // Mark current key as inactive
+        const currentKey = this.encryptionKeys.get(this.activeKeyId);
+        if (currentKey) {
+            currentKey.active = false;
+        }
+        // Generate new key
+        const newKeyId = this.generateKeyId();
+        this.initializeEncryptionKey(newKeyId);
+        this.activeKeyId = newKeyId;
+        // Log key rotation
+        await this.logAuditEvent({
+            eventType: 'system-event',
+            action: 'update',
+            outcome: 'success',
+            actor: {
+                userId: 'system',
+                role: 'system',
+                ipAddress: 'localhost'
+            },
+            resource: {
+                type: 'configuration',
+                description: 'Encryption key rotation'
+            },
+            details: {
+                previousValues: { keyId: currentKey ? this.activeKeyId : 'none' },
+                newValues: { keyId: newKeyId }
+            },
+            security: {
+                authMethod: 'certificate',
+                encryptionUsed: true,
+                integrityVerified: true,
+                accessLevel: 'elevated'
+            }
+        });
+        return newKeyId;
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // DATA MASKING (Minimum Necessary)
+    // ═══════════════════════════════════════════════════════════════════════════════
+    /**
+     * Mask PHI according to minimum necessary standard
+     */
+    maskPHI(data, accessLevel) {
+        const masked = { ...data };
+        // Determine masking rules based on access level
+        const maskingRules = this.getMaskingRulesForLevel(accessLevel);
+        // Apply masking
+        if (masked.ssn && maskingRules.ssnPattern !== 'full') {
+            masked.ssn = this.maskSSN(masked.ssn, maskingRules.ssnPattern);
+        }
+        if (masked.dob && maskingRules.dobPattern !== 'full') {
+            masked.dob = this.maskDOB(masked.dob, maskingRules.dobPattern);
+        }
+        if (masked.phone && maskingRules.phonePattern !== 'full') {
+            masked.phone = this.maskPhone(masked.phone, maskingRules.phonePattern);
+        }
+        if (masked.address && maskingRules.addressPattern !== 'full') {
+            masked.address = this.maskAddress(masked.address, maskingRules.addressPattern);
+        }
+        if (masked.mrn && maskingRules.mrnPattern !== 'full') {
+            masked.mrn = this.maskMRN(masked.mrn, maskingRules.mrnPattern);
+        }
+        if (masked.genomics && maskingRules.genomicPattern !== 'full') {
+            masked.genomics = this.maskGenomics(masked.genomics, maskingRules.genomicPattern);
+        }
+        return masked;
+    }
+    getMaskingRulesForLevel(level) {
+        switch (level) {
+            case 'full':
+                return {
+                    ssnPattern: 'full',
+                    dobPattern: 'full',
+                    phonePattern: 'full',
+                    addressPattern: 'full',
+                    mrnPattern: 'full',
+                    genomicPattern: 'full'
+                };
+            case 'clinical':
+                return {
+                    ssnPattern: 'last4',
+                    dobPattern: 'full',
+                    phonePattern: 'full',
+                    addressPattern: 'full',
+                    mrnPattern: 'full',
+                    genomicPattern: 'full'
+                };
+            case 'billing':
+                return {
+                    ssnPattern: 'last4',
+                    dobPattern: 'full',
+                    phonePattern: 'last4',
+                    addressPattern: 'full',
+                    mrnPattern: 'full',
+                    genomicPattern: 'hidden'
+                };
+            case 'research':
+                return {
+                    ssnPattern: 'hidden',
+                    dobPattern: 'year-only',
+                    phonePattern: 'hidden',
+                    addressPattern: 'zip-only',
+                    mrnPattern: 'hidden',
+                    genomicPattern: 'summary'
+                };
+            case 'minimal':
+            default:
+                return {
+                    ssnPattern: 'hidden',
+                    dobPattern: 'age-only',
+                    phonePattern: 'hidden',
+                    addressPattern: 'hidden',
+                    mrnPattern: 'hidden',
+                    genomicPattern: 'hidden'
+                };
+        }
+    }
+    maskSSN(ssn, pattern) {
+        const cleaned = ssn.replace(/\D/g, '');
+        switch (pattern) {
+            case 'last4':
+                return `***-**-${cleaned.slice(-4)}`;
+            case 'hidden':
+                return '***-**-****';
+            default:
+                return ssn;
+        }
+    }
+    maskDOB(dob, pattern) {
+        const date = typeof dob === 'string' ? new Date(dob) : dob;
+        switch (pattern) {
+            case 'year-only':
+                return date.getFullYear().toString();
+            case 'age-only':
+                const age = Math.floor((Date.now() - date.getTime()) / (365.25 * 24 * 60 * 60 * 1000));
+                return `Age: ${age}`;
+            case 'hidden':
+                return '[REDACTED]';
+            default:
+                return typeof dob === 'string' ? dob : date.toISOString().split('T')[0];
+        }
+    }
+    maskPhone(phone, pattern) {
+        const cleaned = phone.replace(/\D/g, '');
+        switch (pattern) {
+            case 'last4':
+                return `(***) ***-${cleaned.slice(-4)}`;
+            case 'hidden':
+                return '(***) ***-****';
+            default:
+                return phone;
+        }
+    }
+    maskAddress(address, pattern) {
+        if (typeof address === 'string') {
+            switch (pattern) {
+                case 'city-state':
+                    return '[City, State]';
+                case 'zip-only':
+                    const zipMatch = address.match(/\d{5}(-\d{4})?/);
+                    return zipMatch ? zipMatch[0] : '[ZIP]';
+                case 'hidden':
+                    return '[REDACTED]';
+                default:
+                    return address;
+            }
+        }
+        // Object address
+        switch (pattern) {
+            case 'city-state':
+                return { city: address.city, state: address.state };
+            case 'zip-only':
+                return { zip: address.zip || address.postalCode };
+            case 'hidden':
+                return '[REDACTED]';
+            default:
+                return address;
+        }
+    }
+    maskMRN(mrn, pattern) {
+        switch (pattern) {
+            case 'last4':
+                return `****${mrn.slice(-4)}`;
+            case 'hidden':
+                return '[REDACTED]';
+            default:
+                return mrn;
+        }
+    }
+    maskGenomics(genomics, pattern) {
+        switch (pattern) {
+            case 'summary':
+                if (Array.isArray(genomics)) {
+                    return { count: genomics.length, summary: 'Genomic data available' };
+                }
+                return { summary: 'Genomic data available' };
+            case 'hidden':
+                return '[GENOMIC DATA REDACTED]';
+            default:
+                return genomics;
+        }
+    }
+    // ═══════════════════════════════════════════════════════════════════════════════
+    // HELPER METHODS
+    // ═══════════════════════════════════════════════════════════════════════════════
+    generateAuditId() {
+        return `AUD-${Date.now()}-${randomBytes(4).toString('hex')}`;
+    }
+    generateConsentId() {
+        return `CON-${Date.now()}-${randomBytes(4).toString('hex')}`;
+    }
+    generatePolicyId() {
+        return `POL-${Date.now()}-${randomBytes(4).toString('hex')}`;
+    }
+    generateKeyId() {
+        return `KEY-${Date.now()}-${randomBytes(4).toString('hex')}`;
+    }
+    async initializeEncryptionKey(keyId) {
+        const id = keyId || this.activeKeyId;
+        // In production, this would use a proper key management system (KMS)
+        // For now, derive from a master secret
+        const masterSecret = process.env.HIPAA_MASTER_KEY || 'DEFAULT_DEV_KEY_CHANGE_IN_PRODUCTION';
+        return new Promise((resolve, reject) => {
+            scrypt(masterSecret, id, 32, (err, derivedKey) => {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    this.encryptionKeys.set(id, {
+                        key: derivedKey,
+                        createdAt: new Date(),
+                        active: true
+                    });
+                    resolve();
+                }
+            });
+        });
+    }
+    calculateEntryHash(entry) {
+        const content = JSON.stringify({
+            ...entry,
+            timestamp: entry.timestamp.toISOString()
+        });
+        return createHash('sha256').update(content).digest('hex');
+    }
+    async detectSuspiciousActivity(entry) {
+        // Check for patterns that might indicate security issues
+        const suspiciousPatterns = [
+            {
+                pattern: () => entry.action === 'login-failed',
+                alert: 'Failed login attempt'
+            },
+            {
+                pattern: () => entry.security.accessLevel === 'emergency',
+                alert: 'Emergency access used'
+            },
+            {
+                pattern: () => {
+                    // Check for after-hours access
+                    const hour = entry.timestamp.getHours();
+                    return (hour < 6 || hour > 22) && entry.eventType === 'access';
+                },
+                alert: 'After-hours PHI access'
+            },
+            {
+                pattern: () => {
+                    // Check for excessive access
+                    const recentAccess = this.auditStore.filter(e => e.actor.userId === entry.actor.userId &&
+                        e.eventType === 'access' &&
+                        e.timestamp.getTime() > Date.now() - 60000 // Last minute
+                    );
+                    return recentAccess.length > 50;
+                },
+                alert: 'Excessive PHI access rate detected'
+            }
+        ];
+        for (const { pattern, alert } of suspiciousPatterns) {
+            if (pattern()) {
+                this.emit('security-alert', {
+                    timestamp: new Date(),
+                    alert,
+                    auditEntryId: entry.id,
+                    actor: entry.actor,
+                    severity: 'warning'
+                });
+            }
+        }
+    }
+    /**
+     * Export audit logs for compliance reporting
+     */
+    exportAuditLogs(format, params) {
+        const { entries } = this.queryAuditLogs({
+            ...params,
+            limit: 100000
+        });
+        if (format === 'json') {
+            return JSON.stringify(entries, null, 2);
+        }
+        // CSV format
+        const headers = [
+            'ID', 'Timestamp', 'Event Type', 'Action', 'Outcome',
+            'User ID', 'User Role', 'IP Address',
+            'Resource Type', 'Patient ID', 'Access Level'
+        ];
+        const rows = entries.map(e => [
+            e.id,
+            e.timestamp.toISOString(),
+            e.eventType,
+            e.action,
+            e.outcome,
+            e.actor.userId,
+            e.actor.role,
+            e.actor.ipAddress,
+            e.resource.type,
+            e.resource.patientId || '',
+            e.security.accessLevel
+        ]);
+        return [
+            headers.join(','),
+            ...rows.map(r => r.map(v => `"${v}"`).join(','))
+        ].join('\n');
+    }
+}
+export default HIPAAComplianceService;
+//# sourceMappingURL=hipaa.js.map