ceo-orchestration 1.0.0

package/.claude/skills/domains/healthcare/examples/patient-portal-symptom-checker.md

@@ -0,0 +1,130 @@
+---
+plan_id: PLAN-EXAMPLE-HCR
+title: "Add symptom-checker flow to patient portal with clinical routing"
+status: draft
+owner: ceo
+level: L3
+squad: healthcare
+profile: core,healthcare
+created_at: 2026-05-10
+---
+
+# Example PLAN — Add symptom-checker flow to patient portal with clinical routing
+
+> **This is an illustrative example**, not a real plan. It shows how the
+> healthcare squad coordinates on a feature that touches PHI, clinical
+> escalation logic, and marketing analytics on patient-facing pages.
+>
+> Exemplar pattern derived from:
+> `.claude/skills/domains/edtech/examples/PLAN-EXAMPLE.md`
+> `.claude/skills/domains/healthcare/task-chains.yaml`
+
+## 1. Problem
+
+A healthcare network wants to reduce unnecessary emergency department
+visits by adding a symptom checker to the patient portal. The checker
+will ask guided questions about symptoms, recommend urgency level
+(self-care / schedule appointment / urgent care / call 911), and offer
+an immediate telehealth connection for moderate-urgency cases. The
+current portal has a Meta Pixel active on all pages for marketing
+attribution purposes.
+
+Sources:
+- Clinical leadership: 22% of ED visits assessed as primary-care
+  appropriate in the trailing year
+- Patient services: top complaint is inability to self-triage without
+  calling the nurse line
+- Digital team: Meta Pixel currently fires on all pages including the
+  appointment scheduling and patient login pages
+
+## 2. Scope
+
+**In:**
+- Symptom intake form with urgency classification logic (self-care /
+  appointment / urgent care / 911 escalation)
+- Telehealth connection path for moderate-urgency cases
+- Safe-messaging overlay for mental health or self-harm symptom keywords
+- Meta Pixel consent-mode reconfiguration for patient-portal pages
+- PHI dataflow mapping for symptom data stored or transmitted
+
+**Out:**
+- Clinical decision support algorithm (requires separate clinical
+  validation and regulatory pathway — not in this plan)
+- Insurance verification or billing during triage (separate workflow)
+- Changes to the nurse line IVR routing (separate operations scope)
+
+## 3. Squad assignments
+
+| Phase | Owner | Deliverable |
+|---|---|---|
+| P1 — PHI mapping | Bruno Alencar | PHI inventory updated for symptom data fields + egress paths |
+| P2 — BAA coverage | Fernanda Luz | Vendor BAA audit for symptom data pipeline, telehealth vendor, analytics |
+| P3 — Clinical routing design | Dr. Rodrigo Alves | Urgency classification logic + safe-messaging overlay design |
+| P4 — Pixel consent-mode | Valentina Rosario | Consent-mode configured to block Meta Pixel on portal pages pre-consent |
+| P5 — Patient UX | Camila Oliveira | Complaint path, interpreter access, and clinical routing UX review |
+| P6 — Launch review | CEO + all VETO holders | Compliance + Clinical + Marketing sign-off |
+
+## 4. Risk axes and VETO holders
+
+- **Fernanda Luz (Compliance Officer):** Symptom data is PHI under HIPAA
+  and sensitive health data under LGPD. The telehealth vendor and any
+  analytics vendor receiving symptom data must have a signed BAA/DPA →
+  BLOCK if any vendor processes symptom data without a signed agreement on
+  file (HCR-002). Meta Pixel must be blocked on all patient-portal pages
+  before affirmative consent (HCR-003).
+- **Dr. Rodrigo Alves (Clinical Operations Lead):** The urgency
+  classification algorithm must route any ambiguous or moderate-severity
+  symptom to a licensed clinician, not to a FAQ or static content →
+  BLOCK if the escalation logic allows any symptom pattern associated with
+  cardiac, stroke, or psychiatric emergency to reach a non-clinical
+  response (HCR-005, HCR-006, HCR-007).
+- **Valentina Rosario (Healthcare Marketing Compliance):** The Meta Pixel
+  currently active on all portal pages is sending health-intent signals to
+  Meta's algorithm. This must be resolved before the symptom checker
+  launches — consent-mode must block pixel fire before opt-in on all
+  portal pages (HCR-003, HCR-004).
+
+## 5. Task chains invoked
+
+- `healthcare-launch-patient-facing-feature` — primary chain governing
+  PHI mapping → BAA coverage → retention schedule → clinical safety review
+  → analytics consent-mode → patient UX → launch VETO.
+- `healthcare-marketing-campaign-review` — skipped (no promotional asset
+  in this plan); will be invoked separately if the symptom checker is
+  promoted in marketing campaigns that reference patient outcomes.
+
+## 6. Acceptance
+
+- PHI inventory updated to include symptom response data, urgency
+  classification output, and telehealth session metadata (HCR-001)
+- BAA confirmed: telehealth vendor, any NLP/symptom-parsing vendor, and
+  any analytics tool receiving symptom page data (HCR-002)
+- Symptom retention schedule assigned: clinical interaction records 10
+  years per CFM requirement (HCR-012)
+- Clinical escalation tested: "chest pain", "shortness of breath",
+  "thoughts of self-harm" all route to immediate clinician path, not FAQ
+  (HCR-005, HCR-006)
+- Safe-messaging overlay confirmed for mental health symptom keywords
+  across phone, chat, and portal channels (HCR-006)
+- Meta Pixel consent-mode: verified as blocked on all portal pages before
+  affirmative opt-in; verified as not transmitting symptom-page engagement
+  data to Meta audience network (HCR-003)
+- Interpreter access path reachable from symptom checker for non-English
+  speakers (Camila Oliveira sign-off)
+
+## 7. Metrics
+
+- Emergency department visit rate for portal-registered patients (measured
+  at 90 days post-launch vs. prior 90-day cohort)
+- Urgency classification accuracy: rate of "self-care" classifications
+  later upgraded to urgent care within 24 hours (clinical safety signal)
+- **Pixel consent-mode compliance rate** (monitored post-launch; any day
+  where pixel fires on portal page before consent triggers HCR-003 incident
+  review)
+
+## 8. References
+
+- `.claude/skills/domains/healthcare/skills/healthcare-customer-service/SKILL.md`
+- `.claude/skills/domains/healthcare/skills/marketing-compliance/SKILL.md`
+- `.claude/skills/domains/healthcare/task-chains.yaml` — `healthcare-launch-patient-facing-feature`
+- `.claude/skills/domains/healthcare/pitfalls.yaml` — HCR-001, HCR-002, HCR-003, HCR-005, HCR-006, HCR-012

package/.claude/skills/domains/healthcare/pitfalls.yaml

@@ -0,0 +1,74 @@
+# Pitfalls Catalog — Healthcare Squad
+# Loaded alongside the universal catalog when the healthcare profile is
+# installed. Format mirrors .claude/pitfalls-catalog.yaml:
+# id, rule, whenToUse, agents.
+
+pitfalls:
+  # === PHI DATA HANDLING & HIPAA/LGPD COMPLIANCE ===
+  - id: HCR-001
+    rule: "NEVER store PHI in server-side application logs, error tracking payloads, or analytics event properties. Patient names, appointment reasons, diagnosis codes, and insurance IDs are all PHI under HIPAA and sensitive personal data under LGPD Art. 11. Scrubbing must happen before transmission, not post-ingestion."
+    whenToUse: "any logging configuration, error-tracker setup, or analytics event design in a healthcare context"
+    agents: [Bruno Alencar, Fernanda Luz]
+
+  - id: HCR-002
+    rule: "NEVER use a third-party vendor to process PHI without a signed Business Associate Agreement (HIPAA) or Data Processing Agreement (LGPD) on file, with expiry date tracked. A vendor's SOC 2 certification or HIPAA compliance badge does NOT substitute for a signed BAA."
+    whenToUse: "any new vendor onboarding, tool evaluation, or third-party integration in a healthcare data pipeline"
+    agents: [Fernanda Luz]
+
+  - id: HCR-003
+    rule: "NEVER fire a Meta Pixel, Google Tag, or any third-party tracking SDK on a patient-portal page, symptom-checker page, appointment-scheduling page, or any page where health-condition inference is possible — without consent-mode blocking data transmission before affirmative opt-in. OCR (US) and ANPD (BR) have both issued guidance treating this as a PHI breach."
+    whenToUse: "any tag manager configuration, pixel implementation, or analytics SDK setup on a patient-facing digital surface"
+    agents: [Fernanda Luz, Valentina Rosario]
+
+  - id: HCR-004
+    rule: "NEVER use patient health information (diagnosis, appointment reason, medication, condition) as a marketing audience segment, lookalike seed, or retargeting list without individual written HIPAA marketing authorisation (§164.514(e)). Treatment relationship consent is a separate instrument and does NOT cover marketing use."
+    whenToUse: "any marketing audience build, CRM segment export, or retargeting list creation in a healthcare context"
+    agents: [Valentina Rosario, Fernanda Luz]
+
+  # === CLINICAL ESCALATION & PATIENT SAFETY ===
+  - id: HCR-005
+    rule: "NEVER allow an automated system (chatbot, IVR, FAQ) to provide a clinical assessment, differential diagnosis, or treatment recommendation — even framed as 'information, not advice'. Any inquiry that includes symptom description MUST be routed to a licensed clinician. The distinction between 'clinical advice' and 'health information' is not enforceable at scale without clinical review."
+    whenToUse: "any chatbot, IVR, FAQ, or automated patient communication design"
+    agents: [Dr. Rodrigo Alves, Camila Oliveira]
+
+  - id: HCR-006
+    rule: "NEVER weaken or remove safe-messaging guidelines for mental health, suicide, or self-harm inquiries in any patient communication channel. Safe messaging (based on AFSP / WHO guidance) applies to phone, chat, email, and SMS equally — not only to phone scripts."
+    whenToUse: "any patient communication flow design, script review, or chatbot training for healthcare contexts"
+    agents: [Dr. Rodrigo Alves, Camila Oliveira]
+
+  - id: HCR-007
+    rule: "NEVER route a patient who describes a new symptom or pain during what was classified as an administrative call (billing, scheduling) to an administrative hold without first offering clinical routing. Symptom reports received in any context are clinical events."
+    whenToUse: "any call-routing rule change, IVR design, or agent-handling workflow in healthcare customer service"
+    agents: [Dr. Rodrigo Alves, Camila Oliveira]
+
+  - id: HCR-008
+    rule: "NEVER make clinical escalation SLAs longer without explicit sign-off from the Clinical Operations Lead. An increase in callback wait time for clinical questions is a patient-safety parameter, not an operational efficiency decision."
+    whenToUse: "any SLA change, staffing model change, or routing-rule change that affects clinical callback time"
+    agents: [Dr. Rodrigo Alves]
+
+  # === HEALTHCARE MARKETING & PROMOTIONAL CLAIMS ===
+  - id: HCR-009
+    rule: "NEVER publish a promotional health claim without a substantiation file that specifies the clinical evidence level (RCT, meta-analysis, observational study, expert consensus) and the population the evidence applies to. 'Studies show' without a citation is an unsupported claim under FTC and Anvisa standards."
+    whenToUse: "any healthcare marketing asset review, ad copy approval, or content publication in a healthcare context"
+    agents: [Valentina Rosario]
+
+  - id: HCR-010
+    rule: "NEVER imply or state an off-label use of a regulated health product in promotional material. Off-label promotion is prohibited by FDA, Anvisa, and EMA regardless of the clinical evidence that might exist for the use."
+    whenToUse: "any promotional content, sales enablement material, or social media copy for a regulated health product"
+    agents: [Valentina Rosario]
+
+  - id: HCR-011
+    rule: "NEVER publish a patient testimonial that names a health condition, treatment outcome, or medication without individual written HIPAA marketing authorisation. An email or verbal 'yes, use my story' is not HIPAA-compliant authorisation."
+    whenToUse: "any testimonial campaign, case study, or patient-story content piece in a healthcare context"
+    agents: [Valentina Rosario, Fernanda Luz]
+
+  # === DATA RETENTION & BREACH RESPONSE ===
+  - id: HCR-012
+    rule: "NEVER shorten medical record retention schedules without confirming the minimum retention period under BOTH applicable jurisdictions (HIPAA: 6 years from creation or last effective date; CFM/Brazil: 10 years minimum; GDPR: minimum for the processing purpose). The longer period governs when both apply."
+    whenToUse: "any data retention policy change, storage-cost reduction initiative, or data-deletion pipeline design in a healthcare context"
+    agents: [Fernanda Luz, Bruno Alencar]
+
+  - id: HCR-013
+    rule: "NEVER delay activating the breach incident-response playbook beyond 24 hours of breach detection. LGPD requires ANPD notification within 2 working days for high-risk events; HIPAA requires HHS notification within 60 days but MOST state laws require earlier notification. The 24-hour internal activation window ensures the external obligation is met regardless of jurisdiction."
+    whenToUse: "any security incident, PHI exposure event, or anomalous data-access pattern in a healthcare system"
+    agents: [Fernanda Luz, Bruno Alencar]

package/.claude/skills/domains/healthcare/skills/healthcare-customer-service/SKILL.md

@@ -0,0 +1,369 @@
+---
+name: healthcare-customer-service
+description: |
+  Healthcare patient-facing customer service discipline covering appointment
+  scheduling, billing inquiries, complaint handling, insurance navigation,
+  and escalation across clinical, billing, privacy-breach, and safety paths.
+  Governs PHI disclosure under multi-jurisdiction health-data law: HIPAA
+  Privacy + Security + Breach Notification (US) / 42 CFR Part 2 / LGPD
+  Art. 11 + Resolução CFM 2.314 (BR) / GDPR Art. 9 special-category (EU).
+  Never provides medical advice — every clinical question routes to a
+  credentialed clinician. Applies SDOH-aware language and coordinates
+  mandatory interpreter access per CMS Section 1557 (US), Brazilian
+  consumer-protection + SUS + Lei 14.172/2021 sign-language access (BR),
+  and the EU Cross-Border Patients Directive. Use when handling patient inquiries
+  via any channel, triaging complaints, supporting billing disputes,
+  coordinating interpreter or accessibility services, or onboarding staff
+  to PHI-safe patient communication protocols.
+owner: Camila Oliveira (Patient Services Specialist, domain persona)
+tier: domain:healthcare
+scope_tags: [healthcare, patient-services, hipaa, phi, complaint-handling, sdoh-aware, multilingual-access]
+inherits: [core/compliance-lgpd, core/pii-data-flow, core/consent-lifecycle, core/dpo-reporting]
+pii_handling: required
+inspired_by:
+  - source: msitarzewski/agency-agents/specialized/healthcare-customer-service.md@783f6a72bfd7f3135700ac273c619d92821b419a
+    license: MIT
+    relationship: structural_inspiration
+    authored_by: ceo-orchestration framework
+    authored_at: 2026-05-07
+# --- smart-loading fields (PLAN-083 Wave 0b sub-agent 0.7c) ---
+domain: healthcare
+priority: 8
+risk_class: medium
+stack: []
+context_budget_tokens: 600
+inactive_but_retained: true
+repo_profile_binding:
+  frontend: {active: false, priority: 10}
+  engine: {active: false, priority: 10}
+  fintech: {active: false, priority: 10}
+  trading-readonly: {active: false, priority: 10}
+  generic: {active: false, priority: 10}
+activation_triggers: []
+# --- K1 paths: native file-touch activation (PLAN-135 W3 unit k1a) ---
+paths:
+  - "**/patients/**"
+  - "**/appointments/**"
+  - "**/scheduling/**"
+  - "**/complaints/**"
+---
+
+# Healthcare Customer Service
+
+Healthcare patient contact operates at the intersection of sensitive
+personal health data, multi-jurisdiction regulatory obligation, and acute
+human vulnerability. This skill codifies the doctrine that makes every
+patient interaction simultaneously safe, legally compliant, and clinically
+appropriate — anchored by the rule that no advice beyond administrative
+scope is ever given, and no PHI is disclosed without verified identity and
+documented legal basis.
+
+## Cardinal Rule
+
+No clinical advice is provided under any circumstance. Scheduling a
+follow-up appointment is within scope. Explaining what a test result
+means, recommending a medication, interpreting a diagnosis, or suggesting
+a treatment option is not within scope — and providing any of those
+without a clinical licence constitutes patient harm and creates legal
+liability regardless of intent. Every clinical question, symptom inquiry,
+or medication question routes immediately and explicitly to a credentialed
+clinician or pharmacist. This boundary is not negotiable and does not
+bend under patient distress, time pressure, or repeated requests.
+
+## Fail-Fast Rule
+
+Halt the current task and escalate immediately when any of the following
+conditions are present:
+
+1. Patient describes symptoms consistent with a medical emergency — chest
+   pain, difficulty breathing, signs of stroke, severe bleeding, loss of
+   consciousness, or severe allergic reaction. Direct to emergency services
+   immediately; do not continue the original inquiry until safety is
+   confirmed.
+2. Patient expresses suicidal ideation or intent to harm — route to the
+   crisis line (988 in the US; CVV 188 in Brazil; applicable national
+   service elsewhere) and to clinical staff without delay.
+3. PHI disclosure is requested without completed multi-factor identity
+   verification. Halt disclosure; do not proceed on partial verification.
+4. A complaint involves a licensed clinical staff member or a potential
+   patient safety incident. Route to the compliance or risk management
+   function; do not attempt resolution at the service-representative level.
+5. A Business Associate Agreement (BAA) is not confirmed for a third-party
+   system or vendor before any PHI is shared with or through that system.
+
+## When to Apply
+
+Apply this skill for any patient-facing interaction, including:
+
+- Appointment scheduling, rescheduling, cancellations, and waitlist
+  management across in-person, telehealth, and home-visit modalities
+- Billing inquiry resolution, charge explanation, payment plan facilitation,
+  and financial assistance referral
+- Insurance coverage verification, prior-authorization status, denial
+  navigation, and appeal coordination
+- Complaint intake, acknowledgment, documentation, and escalation routing
+- Interpreter or language-access coordination
+- HIPAA patient-rights facilitation — access, amendment, restriction, and
+  accounting of disclosures
+- Medical records release-of-information support (routing only; no release
+  without written authorization unless TPO applies)
+
+Do not apply when the task is internal clinical workflow design or when
+the inquiry is purely between administrative staff with no patient PHI
+involved.
+
+## PHI / PII Handling
+
+PHI is the highest-sensitivity data class in healthcare operations.
+Controls apply at collection, transmission, storage, access, and disposal.
+
+**Verification before any PHI disclosure:**
+Confirm the patient's identity using at minimum two factors before
+discussing any PHI. Standard factors: full legal name plus date of birth
+plus one additional identifier (account number, last four digits of SSN,
+or address on file). Confirming full SSN or full payment card numbers
+verbally is prohibited.
+
+**Relationship verification for caregivers:**
+A caller identifying as a family member, caregiver, or legal guardian
+does not automatically have PHI access rights. Verify a HIPAA
+Authorization or Health Care Proxy on file naming the caller, or a court
+order establishing the relationship. For minor patients, a minor who has
+the right to consent to their own care in a specific category
+(contraception, mental health, substance use treatment) also controls
+that PHI independently of parents — do not disclose without the minor's
+own authorization.
+
+**Minimum-necessary principle:**
+Collect and share only the PHI required for the specific service purpose.
+Do not access visit history or diagnostic detail beyond what the inquiry
+requires.
+
+**PHI transmission:**
+PHI must not be sent via unencrypted email, standard SMS, or consumer
+messaging applications. Patient portal secure messaging, encrypted email
+(S/MIME or equivalent), or phone with identity verification satisfies
+the channel requirement.
+
+**Audit log per access:**
+Log every PHI access event: patient identifier (hashed), staff identifier,
+timestamp, purpose, and channel. Entries are immutable; retain per
+regulatory minimum (HIPAA: 6 years; LGPD: per data processing registry;
+GDPR: per controller retention policy).
+
+**BAA verification:**
+Confirm a Business Associate Agreement (HIPAA) or equivalent
+data-processing agreement (LGPD Art. 39 controller-operator clauses /
+GDPR Art. 28 processor terms) is executed and current before
+transmitting PHI to any third-party system or vendor. PHI transmission
+to an unsigned vendor is a reportable breach.
+
+**LGPD Art. 11 sensitive data + Art. 14 minors:**
+Health data under Brazilian law is sensitive personal data requiring
+explicit legal basis under LGPD Art. 11. Children's and adolescents'
+health data is governed by LGPD Art. 14 (best-interest assessment +
+documented parental or guardian consent for under-12 with enhanced
+protective measures; eligible-student transition for adolescents).
+Cross-link `core/compliance-lgpd` for data subject rights, breach
+notification timelines, and DPO escalation paths.
+
+## HIPAA and Multi-Jurisdiction Compliance
+
+Healthcare operations routinely span jurisdictions with overlapping and
+sometimes conflicting health-data regimes. Identify the applicable law
+set at the start of any compliance determination; apply the most
+protective standard where regimes overlap.
+
+**United States — HIPAA:**
+Privacy Rule (minimum-necessary, TPO permitted disclosures, patient
+rights); Security Rule (administrative/physical/technical safeguards for
+ePHI); Breach Notification Rule (individual + HHS notification within 60
+days of discovery; media notification for breaches affecting >500 state
+residents); 42 CFR Part 2 (substance-use disorder records require
+explicit consent — TPO exceptions do not apply); state mental-health laws
+(California CMIA, New York MHL, Texas MHMR) may impose stricter standards
+than HIPAA — apply the stricter.
+
+**Brazil — LGPD-saúde and CFM:**
+LGPD Art. 11 classifies health data as sensitive personal data; one of
+the enumerated legal bases must be documented before processing. Resolução
+CFM 2.314/2022 governs medical record retention (minimum 20 years),
+electronic health record standards, and patient access rights. Telehealth
+interactions are additionally subject to ANATEL/ANS channel requirements.
+
+**European Union — GDPR Art. 9:**
+Health data requires an Art. 9(2) derogation (Art. 9(2)(h) for health
+care provision; Art. 9(2)(i) for public health) in addition to an Art. 6
+lawful basis. EU Member State laws supplement GDPR. The Cross-Border
+Patients Directive (2011/24/EU) grants patients rights to records and
+information across member states; requests route to the national contact
+point.
+
+## Verification Before Disclosure
+
+Identity verification is a structural gate, not a courtesy check. No PHI
+is disclosed until verification completes.
+
+| Verification scenario | Minimum required |
+|---|---|
+| Patient calling directly | Full name + date of birth + one additional identifier |
+| Caller identifying as caregiver or family member | Patient-signed HIPAA Authorization or Health Care Proxy on file naming the caller |
+| Legal guardian of adult patient | Court order or guardianship documentation on file |
+| Parent of minor patient (non-sensitive category) | Verbal parent identity confirmation + name match against minor's registration |
+| Parent attempting to access minor's self-consented care record | Halt — minor controls this PHI in jurisdictions granting minor consent rights; route to Privacy Officer |
+| Emancipated minor | Emancipation documentation on file; treat as adult for all PHI purposes |
+| Law enforcement request | Route to Privacy Officer immediately; do not disclose without legal review of the request |
+
+Document the verification method and outcome in the interaction record
+before the PHI access event is logged.
+
+## Never-Give-Medical-Advice Rule
+
+The clinical boundary is structural and applies irrespective of the
+channel, the patient's distress level, or how simple the question appears.
+
+Administrative scope (permitted):
+- Scheduling, rescheduling, cancellations
+- Billing charges, payment options, financial assistance programs
+- Insurance coverage status, prior-authorization administrative status
+- Providing general instructions previously documented by the clinical
+  team (appointment preparation instructions, parking, check-in process)
+- Explaining what a department or service line does at a general level
+
+Clinical scope (not permitted — route immediately):
+- Symptom interpretation or triage — route to nurse triage line or
+  on-call clinician
+- Medication questions (dosing, interactions, side effects, refill
+  authorization) — route to prescribing clinician or pharmacist
+- Test result meaning, normal vs. abnormal interpretation — route to
+  ordering clinician
+- Diagnosis confirmation, disease progression, or prognosis — route to
+  treating physician
+- Treatment recommendations, alternative therapy suggestions — route to
+  clinical team
+
+When a patient asks a clinical question, the response acknowledges the
+question, confirms that providing clinical guidance is outside the service
+role, and routes explicitly: "That question requires a clinician — let me
+connect you with [nurse triage line / your care team / the on-call
+provider] right now."
+
+## Complaint Handling
+
+Patient complaints carry distinct regulatory weight under CMS Conditions
+of Participation, ANVISA resolutions, and equivalent national health
+authority requirements. Every complaint is documented regardless of
+perceived severity.
+
+**Five-step protocol:** (1) Acknowledge — validate the experience before
+any policy response; (2) Fact-find — clarify one question at a time,
+reflect back for confirmation; (3) Document — date, channel, hashed
+patient identifier, staff involved, nature, and stated desired outcome;
+(4) Escalate per severity (see Escalation Protocol below); (5) Close
+with a specific commitment — state the action, responsible party, and
+timeline. Generic commitments ("someone will follow up") are not
+acceptable.
+
+Complaints involving a licensed clinical staff member, a patient safety
+incident, a discrimination allegation, or a privacy breach route
+immediately to the compliance or risk management function. Never argue
+with a patient about their clinical experience; arguing without record
+access or clinical authority is outside scope.
+
+## Escalation Protocol
+
+| Path | Trigger | Escalation target | Timing |
+|---|---|---|---|
+| Clinical | Symptom inquiry, medication question, clinical test result | Nurse triage line or on-call clinician | Immediate |
+| Safety emergency | Medical emergency signs, suicidal ideation, self-harm intent | Emergency services (911 / SAMU 192); clinical staff | Immediate — do not continue original call |
+| Legal or risk | Patient mentions attorney, legal action, or formal complaint filing | Supervisor + Risk Management | Within 2 minutes |
+| Privacy breach | Suspected unauthorized PHI disclosure or access | Privacy Officer + Compliance | Immediate; document incident timestamp |
+| Quality-of-care complaint | Complaint about clinical staff conduct or clinical outcome | Patient Advocate + Compliance | Same-day escalation |
+| Billing dispute (high-value) | Disputed balance requiring specialist review | Billing Specialist | Within one business day |
+| Discrimination | Patient alleges disparate treatment on protected grounds | Compliance + Section 1557 / ANS coordinator | Same-day |
+| Standard billing / insurance | Routine inquiry beyond first-contact resolution scope | Billing Specialist or Insurance Coordinator | Next business day |
+
+All escalations use warm transfer: brief the receiving party with context
+before connecting the patient; confirm patient name and issue are received
+before the handoff completes; provide the patient with a direct callback
+number. Cold transfers are not permitted.
+
+## SDOH-Aware Language
+
+Social determinants of health — food security, housing stability,
+transportation access, interpreter access — materially affect a patient's
+ability to comply with scheduling, billing, and follow-up obligations.
+Patient-service interactions must not assume resource availability.
+
+Proactively offer: transportation assistance or ride coordination before
+labelling missed appointments as non-compliance; financial assistance
+screening before pursuing collections; interpreter services before
+treating a language barrier as refusal to engage; telehealth alternatives
+before closing a care gap as patient-driven.
+
+"Non-compliant" as a descriptor for a patient facing a social barrier is
+inaccurate and counterproductive. Document barriers in the social-needs
+field of the record, not as a complaint or non-compliance flag.
+
+## Multilingual Access
+
+Language access is a legal right in multiple jurisdictions, not a
+discretionary service enhancement.
+
+- **CMS Section 1557 (US):** Covered health programs must provide
+  meaningful language access to patients with limited English proficiency
+  (LEP). Qualified interpreter services — not family members, not
+  bilingual staff acting informally — must be offered at no cost to the
+  patient. Written materials in the patient's primary language must be
+  available for vital documents.
+- **Brazil (ANS, SUS, and CDC):** Operators must communicate in
+  Portuguese under the consumer-protection regime (CDC Lei 8.078/1990
+  + applicable ANS provider-network rules); for indigenous and
+  minority language communities, interpreter facilitation per
+  applicable SUS protocols and Lei 14.172/2021 sign-language access
+  apply. Verify the operative ANS resolution at engagement; ANS
+  publishes resolution updates that supersede prior numbering.
+- **EU Cross-Border Patients Directive (2011/24/EU):** Patients exercising
+  cross-border care rights are entitled to information about their
+  treatment in a language they understand; National Contact Points provide
+  translation support for administrative matters.
+
+Requesting a family member to interpret clinical or billing information
+is not acceptable. Family members may not accurately convey clinical
+nuance, may have conflicting interests, and create HIPAA disclosure
+concerns. Coordinate a certified medical interpreter through the
+established interpreter service before proceeding.
+
+## Anti-Patterns
+
+| Anti-pattern | Failure mode | Correction |
+|---|---|---|
+| PHI disclosure to caller without verification | HIPAA breach; notification obligation triggers | Halt disclosure; complete two-factor identity verification before any PHI access |
+| Clinical advice given to avoid escalation delay | Patient harm; liability without clinical licence | Route immediately; acknowledge the boundary explicitly to the patient |
+| Ignoring an interpreter access request | Section 1557 / ANS violation; patient safety risk from miscommunication | Coordinate certified medical interpreter before continuing the interaction |
+| Cold transfer to clinical staff | Patient must repeat context; trust erosion; safety risk if context is lost | Brief the receiving clinician before connecting; confirm handoff is complete |
+| No audit log for PHI access | HIPAA Security Rule violation; inability to detect or report breach | Log every PHI access event with patient identifier, staff identifier, timestamp, and purpose |
+| Collecting PHI beyond minimum necessary | LGPD Art. 11 / HIPAA Privacy Rule violation | Collect only the identifiers required for the specific service task at hand |
+| Using family member as interpreter for clinical or billing matters | HIPAA disclosure to unauthorized party; accuracy risk | Arrange certified medical interpreter; document the coordination |
+| Dismissing social barrier as non-compliance | SDOH-driven care gap mislabelled; patient disengages | Screen for social needs; document in social-needs field; connect to assistance program |
+| Failing to place billing hold during dispute review | Account proceeds to collections while under review | Place billing hold immediately on any disputed account; document the hold timestamp |
+| BAA not verified before PHI transmission to vendor | Reportable breach regardless of vendor conduct | Confirm BAA is executed and current before any PHI enters a third-party system |
+
+## Cross-References
+
+- `core/compliance-lgpd` — LGPD Art. 11 sensitive data controls, Art. 13
+  children's data protections, DPO escalation, breach notification timeline,
+  and data subject rights obligations for Brazilian health data processing
+- `domains/hospitality/skills/guest-services` — complaint acknowledgment
+  and service-recovery doctrine applicable to non-clinical patient-experience
+  dimensions
+- `domains/healthcare/skills/marketing-compliance` — restrictions on
+  communicating health claims and testimonials to prospective patients;
+  CAN-SPAM, ANS, and GDPR consent requirements for health marketing
+
+## ADR Anchors
+
+- **ADR-058** — two-pass adversarial review doctrine; all patient-facing
+  communications templates, PHI handling procedures, and escalation protocol
+  documents undergo a second-pass compliance review before deployment; first
+  draft is not a final instrument