HIPAA Compliance for Recovery Coach

This skill helps you maintain HIPAA compliance when developing features that handle Protected Health Information (PHI).

What is PHI in This Application?

| Data Type | PHI Status | Handling | |-----------|------------|----------| | Check-in mood/cravings | PHI | Audit all access | | Journal entries | PHI | Audit all access | | Chat conversations | PHI | Audit all access | | User profile (name, email) | PHI | Audit modifications | | Sobriety date | PHI | Audit access | | Emergency contacts | PHI | Audit access | | Usage analytics (aggregated) | NOT PHI | No audit needed | | Page views (no content) | NOT PHI | No audit needed |

Audit Logging Requirements

When to Log

Always log these operations:

• Viewing any PHI (check-ins, journal, messages)
• Creating/updating/deleting PHI
• Exporting user data
• Admin access to user information
• Failed authentication attempts
• Security events (rate limiting, unauthorized access)

How to Log

Use the audit logging utilities in src/lib/hipaa/audit.ts:

typescript
import {
  logPHIAccess,
  logPHIModification,
  logSecurityEvent,
  logAdminAction
} from '@/lib/hipaa/audit';

// Viewing PHI
await logPHIAccess(
  userId,
  'checkin',        // targetType
  checkinId,        // targetId
  AuditAction.PHI_VIEW
);

// Modifying PHI
await logPHIModification(
  userId,
  'journal',
  journalId,
  AuditAction.PHI_UPDATE,
  { field: 'content' }  // Never include actual content!
);

// Security event
await logSecurityEvent(
  userId,
  AuditAction.RATE_LIMIT,
  { path: '/api/chat', attempts: 60 }
);

// Admin action
await logAdminAction(
  adminId,
  AuditAction.ADMIN_USER_VIEW,
  'user',
  targetUserId
);

Data Sanitization

Never Log These Fields

The audit system automatically sanitizes, but be explicit:

typescript
// BAD - Contains PHI
await logPHIAccess(userId, 'journal', id, action, {
  content: journalEntry.content  // NEVER DO THIS
});

// GOOD - Only metadata
await logPHIAccess(userId, 'journal', id, action, {
  wordCount: journalEntry.content.length,
  hasAttachments: false
});

Sanitized Fields (Auto-Redacted)

• password, token, secret, key
• authorization, cookie, session
• credential, content, message, notes

Session Security Requirements

From src/lib/auth.ts:

• Session timeout: 15 minutes of inactivity (HIPAA requirement)
• Max session: 8 hours absolute maximum
• Failed login lockout: 5 attempts = 30 minute ban
• Password requirements: 12+ chars, mixed case, numbers, special chars

Code Patterns

API Route with Audit Logging

typescript
import { getSession, requireAuth } from '@/lib/auth';
import { logPHIAccess } from '@/lib/hipaa/audit';

export async function GET(request: Request) {
  const session = await getSession();
  if (!session) {
    return Response.json({ error: 'Unauthorized' }, { status: 401 });
  }

  // Fetch the data
  const data = await fetchUserData(session.userId);

  // Log the access
  await logPHIAccess(
    session.userId,
    'userdata',
    session.userId,
    AuditAction.PHI_VIEW
  );

  return Response.json(data);
}

Component with PHI Access

typescript
'use client';

import { useEffect } from 'react';

export function JournalViewer({ entryId }: { entryId: string }) {
  useEffect(() => {
    // Log view on mount (server-side preferred, but client backup)
    fetch('/api/audit/log', {
      method: 'POST',
      body: JSON.stringify({
        action: 'PHI_VIEW',
        targetType: 'journal',
        targetId: entryId
      })
    });
  }, [entryId]);

  // ... render
}

Compliance Checklist

Before shipping any feature that touches PHI:

• ] All PHI access is audit logged
• ] No PHI content in logs (only IDs and metadata)
• ] Data access requires authentication
• ] Admin access has separate audit trail
• ] Failed access attempts are logged
• ] Data export includes audit entry
• ] Sensitive fields are encrypted at rest
• ] Session timeout is enforced

Audit Log Retention

• Minimum: 6 years (HIPAA requirement)
• Format: Raw logs for 1 year, compressed thereafter
• Location: audit_log table in database
• Export: Encrypted exports for compliance audits

Emergency Access (Break Glass)

For emergency situations, use break-glass access:

typescript
import { requestBreakGlassAccess } from '@/lib/hipaa/break-glass';

// This creates enhanced audit trail
const access = await requestBreakGlassAccess(
  adminId,
  targetUserId,
  'Emergency support required - user reported crisis'
);

Break glass access:

• Requires written justification
• Creates permanent audit record
• Triggers alert to compliance officer
• Must be reviewed within 24 hours

Resources

• HIPAA Security Rule: 45 C.F.R. § 164.312
• Audit controls standard: 45 C.F.R. § 164.312(b)
• Incident response plan: docs/INCIDENT-RESPONSE-PLAN.md
• Security documentation: docs/SECURITY-HARDENING.md