/**
 * HIPAA Compliance Layer
 *
 * Provides comprehensive HIPAA compliance features:
 * - Audit logging (access, modification, disclosure)
 * - Patient consent management
 * - Data encryption (at rest and in transit)
 * - Access control and authentication
 * - Break-the-glass emergency access
 * - Minimum necessary standard enforcement
 * - Business Associate Agreement tracking
 *
 * IMPORTANT: This module implements the technical safeguards required by HIPAA.
 * Administrative and physical safeguards must be implemented organizationally.
 */
import { EventEmitter } from 'events';
export interface AuditLogEntry {
    id: string;
    timestamp: Date;
    eventType: AuditEventType;
    action: AuditAction;
    outcome: 'success' | 'failure' | 'error';
    actor: {
        userId: string;
        userName?: string;
        role: string;
        organization?: string;
        ipAddress: string;
        userAgent?: string;
        sessionId?: string;
    };
    resource: {
        type: 'patient' | 'record' | 'report' | 'order' | 'document' | 'system' | 'configuration';
        id?: string;
        patientId?: string;
        description?: string;
    };
    details?: {
        fieldsAccessed?: string[];
        fieldsModified?: string[];
        previousValues?: Record<string, any>;
        newValues?: Record<string, any>;
        query?: string;
        reason?: string;
        emergencyAccess?: boolean;
        consentId?: string;
    };
    security: {
        authMethod: 'password' | 'mfa' | 'sso' | 'certificate' | 'api-key' | 'oauth';
        encryptionUsed: boolean;
        integrityVerified: boolean;
        accessLevel: 'normal' | 'elevated' | 'emergency';
    };
    entryHash?: string;
    previousEntryHash?: string;
}
export type AuditEventType = 'authentication' | 'authorization' | 'access' | 'modification' | 'disclosure' | 'deletion' | 'export' | 'print' | 'query' | 'emergency-access' | 'consent-change' | 'system-event';
export type AuditAction = 'login' | 'logout' | 'login-failed' | 'session-timeout' | 'view' | 'search' | 'download' | 'print' | 'export' | 'create' | 'update' | 'delete' | 'restore' | 'share' | 'transmit' | 'receive' | 'grant-access' | 'revoke-access' | 'consent-obtained' | 'consent-revoked' | 'emergency-override' | 'break-the-glass';
export interface PatientConsent {
    id: string;
    patientId: string;
    consentType: ConsentType;
    status: 'active' | 'revoked' | 'expired' | 'pending';
    scope: {
        dataCategories: DataCategory[];
        purposes: ConsentPurpose[];
        recipients?: string[];
        excludedProviders?: string[];
        excludedData?: string[];
    };
    validity: {
        effectiveDate: Date;
        expirationDate?: Date;
        autoRenew?: boolean;
    };
    capture: {
        method: 'written' | 'electronic' | 'verbal' | 'implied';
        documentId?: string;
        witnessName?: string;
        witnessDate?: Date;
        ipAddress?: string;
        deviceInfo?: string;
    };
    audit: {
        createdAt: Date;
        createdBy: string;
        modifiedAt?: Date;
        modifiedBy?: string;
        revokedAt?: Date;
        revokedBy?: string;
        revocationReason?: string;
    };
}
export type ConsentType = 'treatment' | 'payment' | 'healthcare-ops' | 'research' | 'marketing' | 'disclosure' | 'genetic-testing' | 'clinical-trial' | 'data-sharing' | 'hie' | 'psychotherapy-notes' | 'substance-abuse';
export type DataCategory = 'demographics' | 'diagnoses' | 'medications' | 'lab-results' | 'imaging' | 'procedures' | 'genomics' | 'mental-health' | 'substance-abuse' | 'hiv-status' | 'sexual-health' | 'domestic-violence' | 'psychotherapy-notes' | 'billing';
export type ConsentPurpose = 'treatment' | 'payment' | 'healthcare-operations' | 'research' | 'public-health' | 'legal' | 'insurance' | 'marketing' | 'fundraising' | 'care-coordination' | 'quality-improvement';
export interface AccessPolicy {
    id: string;
    name: string;
    description?: string;
    subjects: {
        roles?: string[];
        users?: string[];
        organizations?: string[];
        departments?: string[];
    };
    resources: {
        types?: string[];
        patientIds?: string[];
        dataCategories?: DataCategory[];
    };
    permissions: {
        actions: ('read' | 'write' | 'delete' | 'share' | 'print' | 'export')[];
        conditions?: AccessCondition[];
    };
    priority: number;
    enabled: boolean;
}
export interface AccessCondition {
    type: 'time-of-day' | 'ip-range' | 'location' | 'mfa-required' | 'relationship' | 'purpose' | 'emergency-only';
    parameters: Record<string, any>;
}
export interface AccessDecision {
    allowed: boolean;
    policy?: string;
    reason: string;
    conditions?: string[];
    requiresElevation?: boolean;
    auditRequired: boolean;
}
export interface EncryptionConfig {
    algorithm: 'aes-256-gcm' | 'aes-256-cbc' | 'chacha20-poly1305';
    keyDerivation: 'scrypt' | 'pbkdf2' | 'argon2';
    keyRotationDays: number;
    fieldLevelEncryption: boolean;
    encryptedFields?: string[];
}
export interface EncryptedData {
    ciphertext: string;
    iv: string;
    authTag?: string;
    keyId: string;
    algorithm: string;
    encryptedAt: Date;
}
export interface DataMaskingConfig {
    ssnPattern: 'full' | 'last4' | 'hidden';
    dobPattern: 'full' | 'year-only' | 'age-only' | 'hidden';
    phonePattern: 'full' | 'last4' | 'hidden';
    addressPattern: 'full' | 'city-state' | 'zip-only' | 'hidden';
    mrnPattern: 'full' | 'last4' | 'hidden';
    genomicPattern: 'full' | 'summary' | 'hidden';
}
export declare class HIPAAComplianceService extends EventEmitter {
    private auditStore;
    private consents;
    private accessPolicies;
    private encryptionKeys;
    private activeKeyId;
    private config;
    private lastEntryHash?;
    constructor(config?: Partial<{
        encryption: Partial<EncryptionConfig>;
        masking: Partial<DataMaskingConfig>;
        auditRetentionDays: number;
        emergencyAccessEnabled: boolean;
    }>);
    /**
     * Log an audit event
     */
    logAuditEvent(entry: Omit<AuditLogEntry, 'id' | 'timestamp' | 'entryHash' | 'previousEntryHash'>): Promise<string>;
    /**
     * Log PHI access event
     */
    logPHIAccess(params: {
        userId: string;
        userName?: string;
        role: string;
        ipAddress: string;
        patientId: string;
        action: 'view' | 'download' | 'print' | 'export';
        resourceType: AuditLogEntry['resource']['type'];
        resourceId?: string;
        fieldsAccessed?: string[];
        reason?: string;
        emergencyAccess?: boolean;
        consentId?: string;
    }): Promise<string>;
    /**
     * Log PHI modification event
     */
    logPHIModification(params: {
        userId: string;
        role: string;
        ipAddress: string;
        patientId: string;
        action: 'create' | 'update' | 'delete';
        resourceType: AuditLogEntry['resource']['type'];
        resourceId?: string;
        fieldsModified?: string[];
        previousValues?: Record<string, any>;
        newValues?: Record<string, any>;
        reason?: string;
    }): Promise<string>;
    /**
     * Log authentication event
     */
    logAuthentication(params: {
        userId: string;
        ipAddress: string;
        action: 'login' | 'logout' | 'login-failed' | 'session-timeout';
        authMethod: AuditLogEntry['security']['authMethod'];
        success: boolean;
        failureReason?: string;
    }): Promise<string>;
    /**
     * Query audit logs
     */
    queryAuditLogs(params: {
        startDate?: Date;
        endDate?: Date;
        patientId?: string;
        userId?: string;
        eventType?: AuditEventType;
        action?: AuditAction;
        outcome?: 'success' | 'failure';
        limit?: number;
        offset?: number;
    }): {
        entries: AuditLogEntry[];
        total: number;
    };
    /**
     * Get accounting of disclosures for a patient (HIPAA requirement)
     */
    getAccountingOfDisclosures(patientId: string, startDate?: Date, endDate?: Date): AuditLogEntry[];
    /**
     * Verify audit log integrity
     */
    verifyAuditLogIntegrity(): {
        valid: boolean;
        errors: string[];
    };
    /**
     * Record a patient consent
     */
    recordConsent(consent: Omit<PatientConsent, 'id' | 'audit'>): Promise<string>;
    /**
     * Revoke a patient consent
     */
    revokeConsent(consentId: string, revokedBy: string, reason?: string): Promise<boolean>;
    /**
     * Check if a patient has consented to a specific use
     */
    checkConsent(patientId: string, purpose: ConsentPurpose, dataCategory?: DataCategory): {
        hasConsent: boolean;
        consentId?: string;
        restrictions?: string[];
    };
    /**
     * Get all consents for a patient
     */
    getPatientConsents(patientId: string): PatientConsent[];
    /**
     * Add an access policy
     */
    addAccessPolicy(policy: Omit<AccessPolicy, 'id'>): string;
    /**
     * Check if access should be allowed
     */
    checkAccess(request: {
        userId: string;
        role: string;
        organization?: string;
        action: 'read' | 'write' | 'delete' | 'share' | 'print' | 'export';
        resourceType: string;
        patientId?: string;
        dataCategory?: DataCategory;
        purpose?: ConsentPurpose;
        ipAddress?: string;
        time?: Date;
        emergencyAccess?: boolean;
    }): AccessDecision;
    private evaluateConditions;
    /**
     * Encrypt sensitive data
     */
    encryptData(data: string | Buffer, context?: string): Promise<EncryptedData>;
    /**
     * Decrypt data
     */
    decryptData(encrypted: EncryptedData, context?: string): Promise<Buffer>;
    /**
     * Encrypt specific PHI fields in an object
     */
    encryptPHI<T extends Record<string, any>>(data: T): Promise<T & {
        _encrypted: Record<string, EncryptedData>;
    }>;
    /**
     * Decrypt PHI fields in an object
     */
    decryptPHI<T extends Record<string, any>>(data: T & {
        _encrypted?: Record<string, EncryptedData>;
    }): Promise<T>;
    /**
     * Rotate encryption keys
     */
    rotateEncryptionKey(): Promise<string>;
    /**
     * Mask PHI according to minimum necessary standard
     */
    maskPHI(data: Record<string, any>, accessLevel: 'full' | 'clinical' | 'billing' | 'research' | 'minimal'): Record<string, any>;
    private getMaskingRulesForLevel;
    private maskSSN;
    private maskDOB;
    private maskPhone;
    private maskAddress;
    private maskMRN;
    private maskGenomics;
    private generateAuditId;
    private generateConsentId;
    private generatePolicyId;
    private generateKeyId;
    private initializeEncryptionKey;
    private calculateEntryHash;
    private detectSuspiciousActivity;
    /**
     * Export audit logs for compliance reporting
     */
    exportAuditLogs(format: 'json' | 'csv', params?: {
        startDate?: Date;
        endDate?: Date;
        patientId?: string;
    }): string;
}
export default HIPAAComplianceService;
//# sourceMappingURL=hipaa.d.ts.map