"""HIPAA as Applied to Dental Practices — 30+ checks.

Covers PHI handling, digital radiograph security, patient portals,
communication rules, record retention, BAAs, breach notification,
risk assessment, staff training, and social media compliance.
"""

from __future__ import annotations

HIPAA_DENTAL_CONTROLS: dict = {
    # ── PHI Handling ──
    "PHI-1": {
        "name": "Patient PHI Handling in Dental Context",
        "regulation_reference": "45 CFR 164.530(c) — Safeguards",
        "checks": [
            {
                "id": "PHI-1.1",
                "check": "Patient charts and records stored securely (locked cabinets or encrypted digital)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Paper records in locked cabinets. Digital records in encrypted, access-controlled systems. No patient files left on counters or in operatories between appointments.",
                "practice_types": ["all"],
            },
            {
                "id": "PHI-1.2",
                "check": "Computer screens positioned to prevent patient view of other patients' records",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Position monitors away from patient view. Use privacy screens. Enable automatic screen lock after 2 minutes of inactivity.",
                "practice_types": ["all"],
            },
            {
                "id": "PHI-1.3",
                "check": "Sign-in sheets do not reveal reason for visit or other PHI",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "medium",
                "remediation": "Sign-in sheets should collect only name and arrival time. Remove sheets after patient signs in. Consider electronic check-in.",
                "practice_types": ["all"],
            },
            {
                "id": "PHI-1.4",
                "check": "Conversations about patient care conducted in private areas",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "medium",
                "remediation": "Discuss patient information in private areas, not at reception desk or in hallways. Use reasonable safeguards for verbal communications.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Digital Radiograph Security ──
    "RAD-SEC-1": {
        "name": "Digital Radiograph Storage and Transmission",
        "regulation_reference": "45 CFR 164.312(a)(2)(iv) — Encryption",
        "checks": [
            {
                "id": "RAD-SEC-1.1",
                "check": "Digital radiographs stored in encrypted, access-controlled system",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Store digital radiographs in HIPAA-compliant imaging software with encryption at rest (AES-256). Role-based access controls required.",
                "practice_types": ["all"],
            },
            {
                "id": "RAD-SEC-1.2",
                "check": "Radiograph transmission uses encrypted channels (TLS/SSL)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Use encrypted email, secure portal, or DICOM with TLS for transmitting radiographs to specialists, insurance, or patients. Never send PHI via unencrypted email.",
                "practice_types": ["all"],
            },
            {
                "id": "RAD-SEC-1.3",
                "check": "Backup procedure for digital radiographs documented and tested",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Implement automated encrypted backups of imaging database. Test restoration quarterly. Follow 3-2-1 backup rule (3 copies, 2 media types, 1 offsite).",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Patient Portal Security ──
    "PORTAL-1": {
        "name": "Patient Portal Security",
        "regulation_reference": "45 CFR 164.312 — Technical Safeguards",
        "checks": [
            {
                "id": "PORTAL-1.1",
                "check": "Patient portal uses strong authentication (unique ID + password)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Implement unique user IDs with strong password requirements (8+ chars, complexity). Consider MFA for portal access.",
                "practice_types": ["all"],
            },
            {
                "id": "PORTAL-1.2",
                "check": "Patient portal sessions time out after period of inactivity",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "medium",
                "remediation": "Configure automatic session timeout after 15-30 minutes of inactivity. Require re-authentication after timeout.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Communication ──
    "COMM-1": {
        "name": "Patient Communication — PHI Rules",
        "regulation_reference": "45 CFR 164.522(b) — Confidential Communications",
        "checks": [
            {
                "id": "COMM-1.1",
                "check": "Patient communication preferences documented (phone, text, email)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Document patient's preferred communication method and any restrictions. Honor requests for alternative communication methods.",
                "practice_types": ["all"],
            },
            {
                "id": "COMM-1.2",
                "check": "Text/SMS appointment reminders do not contain PHI beyond appointment date/time",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Limit text messages to appointment date/time and office name. Do not include treatment details, diagnosis codes, or other PHI in texts.",
                "practice_types": ["all"],
            },
            {
                "id": "COMM-1.3",
                "check": "Patient authorization obtained for email communication containing PHI",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Obtain written authorization before sending PHI via email. Warn patient of risks. Use encrypted email when possible.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Record Retention ──
    "RETAIN-1": {
        "name": "Dental Record Retention",
        "regulation_reference": "State-specific statutes; 45 CFR 164.530(j)",
        "checks": [
            {
                "id": "RETAIN-1.1",
                "check": "Record retention policy documented per state requirements",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Document retention policy. Common requirements: adult records 6-10 years from last visit, minor records until age 18-21 + retention period. Check your state.",
                "practice_types": ["all"],
            },
            {
                "id": "RETAIN-1.2",
                "check": "Record destruction procedures ensure PHI is unrecoverable",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Shred paper records (cross-cut shredder). Degauss/overwrite/physically destroy electronic media. Document destruction (date, method, records destroyed).",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Business Associate Agreements ──
    "BAA-1": {
        "name": "Business Associate Agreements",
        "regulation_reference": "45 CFR 164.502(e) — Business Associates",
        "checks": [
            {
                "id": "BAA-1.1",
                "check": "BAAs in place with dental labs that handle patient information",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Execute BAAs with all dental laboratories that receive patient information (name, tooth numbers, shade, etc. on Rx forms).",
                "practice_types": ["all"],
            },
            {
                "id": "BAA-1.2",
                "check": "BAAs in place with IT service providers and cloud software vendors",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Execute BAAs with all IT providers, practice management software vendors (Dentrix, Eaglesoft, Open Dental), imaging software, cloud backup, email hosting.",
                "practice_types": ["all"],
            },
            {
                "id": "BAA-1.3",
                "check": "BAAs in place with billing companies and clearinghouses",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Execute BAAs with dental billing companies, insurance clearinghouses, and any entity that processes claims or handles PHI on your behalf.",
                "practice_types": ["all"],
            },
            {
                "id": "BAA-1.4",
                "check": "BAA inventory maintained and reviewed annually",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Maintain a list of all business associates with BAA status, execution date, and renewal date. Review annually.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Breach Notification ──
    "BREACH-1": {
        "name": "Breach Notification Procedures",
        "regulation_reference": "45 CFR 164.400-414 — Breach Notification Rule",
        "checks": [
            {
                "id": "BREACH-1.1",
                "check": "Breach notification policy and procedures documented",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Document breach notification procedures: detection, investigation, risk assessment, notification to individuals (within 60 days), HHS reporting, media notification (if 500+ individuals).",
                "practice_types": ["all"],
            },
            {
                "id": "BREACH-1.2",
                "check": "Breach risk assessment methodology documented (4-factor test)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Document 4-factor risk assessment: (1) nature/extent of PHI, (2) unauthorized person, (3) whether PHI was acquired/viewed, (4) mitigation extent.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Risk Assessment ──
    "RISK-1": {
        "name": "Security Risk Assessment",
        "regulation_reference": "45 CFR 164.308(a)(1)(ii)(A) — Risk Analysis",
        "checks": [
            {
                "id": "RISK-1.1",
                "check": "Security risk assessment completed (SRA) and documented",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Complete Security Risk Assessment annually. Use HHS SRA Tool or equivalent. Document: threats identified, vulnerabilities, likelihood, impact, current safeguards, risk level.",
                "practice_types": ["all"],
            },
            {
                "id": "RISK-1.2",
                "check": "Risk management plan addresses identified vulnerabilities",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Create risk management plan with: corrective actions for each identified risk, responsible parties, implementation timelines, completion dates.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Staff Training and Access ──
    "ACCESS-1": {
        "name": "Staff Training and Access Controls",
        "regulation_reference": "45 CFR 164.308(a)(5) — Security Awareness Training",
        "checks": [
            {
                "id": "ACCESS-1.1",
                "check": "HIPAA privacy and security training completed by all staff",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Train all workforce members on HIPAA privacy and security. Document training date, content, and attestation. Train new hires within 30 days.",
                "practice_types": ["all"],
            },
            {
                "id": "ACCESS-1.2",
                "check": "Role-based access to patient records implemented",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Implement minimum necessary access. Front desk: scheduling and demographics. Clinical: treatment records. Billing: financial and insurance. Restrict access accordingly.",
                "practice_types": ["all"],
            },
            {
                "id": "ACCESS-1.3",
                "check": "Unique user IDs assigned to each staff member (no shared logins)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Assign unique login credentials to each staff member. No shared accounts. Enable audit trail to track who accessed what records.",
                "practice_types": ["all"],
            },
            {
                "id": "ACCESS-1.4",
                "check": "Terminated employee access revoked immediately",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Revoke all system access immediately upon employee termination. Change shared passwords. Collect keys, badges, and devices. Document access revocation.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Physical Safeguards ──
    "PHYS-1": {
        "name": "Physical Safeguards",
        "regulation_reference": "45 CFR 164.310 — Physical Safeguards",
        "checks": [
            {
                "id": "PHYS-1.1",
                "check": "Server/network equipment stored in locked, access-controlled area",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Store servers, network equipment, and backup media in a locked room or cabinet with restricted access. Log access to server room.",
                "practice_types": ["all"],
            },
            {
                "id": "PHYS-1.2",
                "check": "Workstation use policy defines appropriate use and physical safeguards",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "medium",
                "remediation": "Create workstation use policy covering: authorized users, acceptable use, physical security (screen positioning, clean desk), automatic logoff settings.",
                "practice_types": ["all"],
            },
            {
                "id": "PHYS-1.3",
                "check": "Device and media disposal procedures documented (hard drives, removable media)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Document procedures for disposing of or re-using devices containing ePHI. Degauss, overwrite, or physically destroy. Certificate of destruction for outsourced disposal.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Technical Safeguards ──
    "TECHSAFE-1": {
        "name": "Technical Safeguards",
        "regulation_reference": "45 CFR 164.312 — Technical Safeguards",
        "checks": [
            {
                "id": "TECHSAFE-1.1",
                "check": "Anti-malware software installed and updated on all workstations",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Install and maintain anti-malware/antivirus software on all workstations and servers. Enable automatic updates and scheduled scans.",
                "practice_types": ["all"],
            },
            {
                "id": "TECHSAFE-1.2",
                "check": "Firewall configured on practice network",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Configure firewall on practice network. Restrict inbound connections. Separate guest WiFi from practice network containing ePHI.",
                "practice_types": ["all"],
            },
            {
                "id": "TECHSAFE-1.3",
                "check": "Automatic logoff configured on all workstations (max 15 minutes)",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "medium",
                "remediation": "Configure automatic screen lock/logoff after 10-15 minutes of inactivity on all workstations. Require re-authentication to resume.",
                "practice_types": ["all"],
            },
            {
                "id": "TECHSAFE-1.4",
                "check": "Audit controls enabled — access to ePHI logged and reviewable",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Enable audit logging in practice management software. Track: who accessed records, when, and what actions taken. Review logs periodically for unauthorized access.",
                "practice_types": ["all"],
            },
        ],
    },
    # ── Social Media / Marketing ──
    "SOCIAL-1": {
        "name": "Social Media and Marketing Compliance",
        "regulation_reference": "45 CFR 164.508 — Authorization; FTC Guidelines",
        "checks": [
            {
                "id": "SOCIAL-1.1",
                "check": "Written patient authorization obtained for before/after photos",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "critical",
                "remediation": "Obtain HIPAA-compliant written authorization specifically listing: use for marketing/social media, types of photos, where they will be posted, right to revoke.",
                "practice_types": ["all"],
            },
            {
                "id": "SOCIAL-1.2",
                "check": "Patient testimonials have written authorization and HIPAA compliance",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Written authorization required for testimonials. Ensure no PHI beyond what patient consents to disclose. FTC requires disclosure if incentives provided.",
                "practice_types": ["all"],
            },
            {
                "id": "SOCIAL-1.3",
                "check": "Social media policy prohibits staff from posting patient information",
                "scanner": "practice",
                "auto_fix": False,
                "severity": "high",
                "remediation": "Create social media policy: no patient photos without authorization, no comments about patients, no identifiable information. Train all staff.",
                "practice_types": ["all"],
            },
        ],
    },
}
