HIPAA & GDPR in Healthcare Systems: A Developer's Complete Implementation Guide

Special category data (Article 9):
├── Health and medical data           ← all healthcare apps
├── Genetic data                      ← genomics, labs
├── Biometric data used for ID        ← fingerprint auth, face scans
├── Mental health data                ← therapy apps, psychiatry
├── Sexual orientation                ← LGBTQ+ health services
└── Race/ethnicity                    ← certain clinical contexts

// Infrastructure/Encryption/FieldEncryption.cs
public sealed class FieldEncryptionService
{
    private readonly byte[] _key;
    private readonly byte[] _iv;

    public FieldEncryptionService(IOptions<EncryptionOptions> options)
    {
        // Key must be stored in AWS KMS, Azure Key Vault, or HashiCorp Vault
        // NEVER in appsettings.json or environment variables
        _key = Convert.FromBase64String(options.Value.DataEncryptionKey);
        _iv  = Convert.FromBase64String(options.Value.InitialisationVector);
    }

    public string Encrypt(string plaintext)
    {
        using var aes = Aes.Create();
        aes.Key  = _key;
        aes.IV   = _iv;
        aes.Mode = CipherMode.CBC;
        aes.Padding = PaddingMode.PKCS7;

        using var encryptor   = aes.CreateEncryptor();
        using var ms          = new MemoryStream();
        using var cryptoStream = new CryptoStream(ms, encryptor, CryptoStreamMode.Write);
        using var writer       = new StreamWriter(cryptoStream);

        writer.Write(plaintext);
        writer.Flush();
        cryptoStream.FlushFinalBlock();

        return Convert.ToBase64String(ms.ToArray());
    }

    public string Decrypt(string ciphertext)
    {
        using var aes = Aes.Create();
        aes.Key  = _key;
        aes.IV   = _iv;
        aes.Mode = CipherMode.CBC;
        aes.Padding = PaddingMode.PKCS7;

        var cipherBytes = Convert.FromBase64String(ciphertext);

        using var decryptor    = aes.CreateDecryptor();
        using var ms           = new MemoryStream(cipherBytes);
        using var cryptoStream = new CryptoStream(ms, decryptor, CryptoStreamMode.Read);
        using var reader       = new StreamReader(cryptoStream);

        return reader.ReadToEnd();
    }
}

// Infrastructure/Persistence/Converters/EncryptedStringConverter.cs
public class EncryptedStringConverter : ValueConverter<string, string>
{
    public EncryptedStringConverter(FieldEncryptionService enc)
        : base(
            v => enc.Encrypt(v),           // to database
            v => enc.Decrypt(v)            // from database
        ) { }
}

// Infrastructure/Persistence/Configurations/PatientConfiguration.cs
public class PatientConfiguration : IEntityTypeConfiguration<Patient>
{
    private readonly FieldEncryptionService _enc;

    public PatientConfiguration(FieldEncryptionService enc) => _enc = enc;

    public void Configure(EntityTypeBuilder<Patient> builder)
    {
        var converter = new EncryptedStringConverter(_enc);

        // PHI fields — encrypted at rest
        builder.Property(p => p.DateOfBirth)
               .HasConversion(converter)
               .HasColumnType("text");

        builder.Property(p => p.SocialSecurityNumber)
               .HasConversion(converter)
               .HasColumnType("text");

        builder.Property(p => p.HomeAddress)
               .HasConversion(converter)
               .HasColumnType("text");

        builder.Property(p => p.PhoneNumber)
               .HasConversion(converter)
               .HasColumnType("text");

        builder.Property(p => p.InsuranceMemberId)
               .HasConversion(converter)
               .HasColumnType("text");

        // Non-PHI fields — stored plaintext
        builder.Property(p => p.ClinicId).HasColumnType("uuid");
        builder.Property(p => p.CreatedAt).HasColumnType("timestamptz");
    }
}

// Infrastructure/KeyManagement/AwsKmsKeyService.cs
public class AwsKmsKeyService : IKeyService
{
    private readonly IAmazonKeyManagementService _kms;
    private readonly string _keyId;

    public async Task<byte[]> GetDataKeyAsync(string context)
    {
        var response = await _kms.GenerateDataKeyAsync(new GenerateDataKeyRequest
        {
            KeyId  = _keyId,
            KeySpec = DataKeySpec.AES_256,
            EncryptionContext = new Dictionary<string, string>
            {
                ["context"] = context,    // e.g. "patient-records"
                ["service"] = "clinic-api"
            }
        });

        // Store response.CiphertextBlob alongside the data
        // Use response.Plaintext for encryption, then clear it from memory
        return response.Plaintext.ToArray();
    }
}

// Program.cs
builder.Services.AddHsts(options =>
{
    options.Preload           = true;
    options.IncludeSubDomains = true;
    options.MaxAge            = TimeSpan.FromDays(365);
});

app.UseHsts();
app.UseHttpsRedirection();

// Reject any non-TLS 1.2+ connections at the reverse proxy (nginx):

# nginx.conf
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers   ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
ssl_prefer_server_ciphers on;

# HSTS header
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";

Every time PHI is accessed:     WHO accessed WHAT, WHEN, FROM WHERE, WHY
Every time PHI is modified:     Old value → New value, by whom, when
Every time PHI is exported:     Destination, format, volume
Every failed access attempt:    Who tried, what they tried to access
Every login/logout:             With MFA status, IP address
Every permission change:        Who granted what to whom

// Domain/Audit/AuditEntry.cs
public record AuditEntry
{
    public Guid     Id            { get; init; } = Guid.NewGuid();
    public string   UserId        { get; init; } = default!;
    public string   UserRole      { get; init; } = default!;
    public string   Action        { get; init; } = default!;  // READ, WRITE, DELETE, EXPORT
    public string   ResourceType  { get; init; } = default!;  // "Patient", "Appointment"
    public string   ResourceId    { get; init; } = default!;
    public string?  PatientId     { get; init; }               // always set for PHI access
    public string?  OldValues     { get; init; }               // JSON, encrypted
    public string?  NewValues     { get; init; }               // JSON, encrypted
    public string   IpAddress     { get; init; } = default!;
    public string   UserAgent     { get; init; } = default!;
    public string?  Reason        { get; init; }               // clinical justification
    public DateTime OccurredAt    { get; init; } = DateTime.UtcNow;
    public bool     WasSuccessful { get; init; }
    public string?  FailureReason { get; init; }
}

// Infrastructure/Audit/AuditService.cs
public class AuditService : IAuditService
{
    private readonly AuditDbContext   _auditDb;     // separate DB from main app
    private readonly IHttpContextAccessor _http;
    private readonly ILogger<AuditService> _log;

    public async Task LogPhiAccessAsync(
        string resourceType,
        string resourceId,
        string patientId,
        string action,
        bool   success,
        string? reason = null)
    {
        var user     = _http.HttpContext?.User;
        var userId   = user?.FindFirst(ClaimTypes.NameIdentifier)?.Value ?? "system";
        var userRole = user?.FindFirst(ClaimTypes.Role)?.Value ?? "unknown";
        var ip       = _http.HttpContext?.Connection.RemoteIpAddress?.ToString() ?? "unknown";
        var ua       = _http.HttpContext?.Request.Headers.UserAgent.ToString() ?? "";

        var entry = new AuditEntry
        {
            UserId       = userId,
            UserRole     = userRole,
            Action       = action,
            ResourceType = resourceType,
            ResourceId   = resourceId,
            PatientId    = patientId,
            IpAddress    = ip,
            UserAgent    = ua,
            Reason       = reason,
            WasSuccessful= success,
        };

        // Write to separate audit database — app user has INSERT only, no UPDATE/DELETE
        await _auditDb.AuditEntries.AddAsync(entry);
        await _auditDb.SaveChangesAsync();

        // Also stream to CloudWatch / SIEM for real-time alerting
        _log.LogInformation("PHI_ACCESS {Action} {ResourceType}/{ResourceId} patient={PatientId} user={UserId} ip={Ip}",
            action, resourceType, resourceId, patientId, userId, ip);
    }
}

-- PostgreSQL: audit DB setup
CREATE USER clinic_app_user WITH PASSWORD '...';
CREATE USER clinic_audit_writer WITH PASSWORD '...';

-- App user: full access to main tables
GRANT SELECT, INSERT, UPDATE ON ALL TABLES IN SCHEMA public TO clinic_app_user;

-- Audit writer: INSERT ONLY on audit table — can never update or delete
GRANT INSERT ON audit_entries TO clinic_audit_writer;
REVOKE UPDATE, DELETE ON audit_entries FROM clinic_audit_writer;

-- Lock down the table further with row security
ALTER TABLE audit_entries ENABLE ROW LEVEL SECURITY;

// Infrastructure/Persistence/Interceptors/AuditInterceptor.cs
public class AuditInterceptor : SaveChangesInterceptor
{
    private readonly IAuditService _audit;
    private readonly IHttpContextAccessor _http;

    public override async ValueTask<InterceptionResult<int>> SavingChangesAsync(
        DbContextEventData eventData,
        InterceptionResult<int> result,
        CancellationToken ct = default)
    {
        var context = eventData.Context!;

        var auditableEntries = context.ChangeTracker.Entries()
            .Where(e => e.Entity is IAuditable &&
                        e.State is EntityState.Added or EntityState.Modified or EntityState.Deleted)
            .ToList();

        foreach (var entry in auditableEntries)
        {
            var action = entry.State switch
            {
                EntityState.Added    => "CREATE",
                EntityState.Modified => "UPDATE",
                EntityState.Deleted  => "DELETE",
                _                   => "UNKNOWN"
            };

            var patientId = entry.Entity is IPatientOwned po ? po.PatientId : null;

            await _audit.LogPhiAccessAsync(
                resourceType: entry.Entity.GetType().Name,
                resourceId:   entry.Property("Id").CurrentValue?.ToString() ?? "unknown",
                patientId:    patientId ?? "N/A",
                action:       action,
                success:      true
            );
        }

        return await base.SavingChangesAsync(eventData, result, ct);
    }
}

// Domain/Authorization/HealthcareRoles.cs
public static class HealthcareRoles
{
    public const string SystemAdmin       = "system_admin";
    public const string ClinicAdmin       = "clinic_admin";
    public const string Physician         = "physician";
    public const string Nurse             = "nurse";
    public const string FrontDesk         = "front_desk";
    public const string BillingStaff      = "billing";
    public const string Patient           = "patient";
    public const string ExternalAuditor   = "auditor";       // read-only, no PHI
}

// What each role can see — principle of minimum necessary
public static class PhiAccessPolicy
{
    // Front desk: schedule + demographics, NO clinical notes
    public const string Demographics   = "phi:demographics";
    public const string Scheduling     = "phi:scheduling";

    // Clinical staff: clinical notes + diagnoses
    public const string ClinicalNotes  = "phi:clinical_notes";
    public const string Diagnoses      = "phi:diagnoses";
    public const string Prescriptions  = "phi:prescriptions";

    // Billing: insurance + billing codes, NO clinical details
    public const string BillingInfo    = "phi:billing";
    public const string InsuranceInfo  = "phi:insurance";
}

// Application/Authorization/PatientDataAuthorizationHandler.cs
public class PatientDataAuthorizationHandler
    : AuthorizationHandler<PatientDataRequirement, Patient>
{
    protected override Task HandleRequirementAsync(
        AuthorizationHandlerContext context,
        PatientDataRequirement requirement,
        Patient patient)
    {
        var user   = context.User;
        var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        var role   = user.FindFirst(ClaimTypes.Role)?.Value;

        // Patients can always access their own records
        if (role == HealthcareRoles.Patient && patient.UserId == userId)
        {
            context.Succeed(requirement);
            return Task.CompletedTask;
        }

        // Physicians: treating physician only (not all physicians in system)
        if (role == HealthcareRoles.Physician)
        {
            var clinicId = user.FindFirst("clinic_id")?.Value;
            if (patient.ClinicId == clinicId)
            {
                context.Succeed(requirement);
                return Task.CompletedTask;
            }
        }

        // Front desk: only for scheduling-related access
        if (role == HealthcareRoles.FrontDesk &&
            requirement.AccessType == PhiAccessPolicy.Scheduling)
        {
            var clinicId = user.FindFirst("clinic_id")?.Value;
            if (patient.ClinicId == clinicId)
            {
                context.Succeed(requirement);
                return Task.CompletedTask;
            }
        }

        // Default: deny
        context.Fail();
        return Task.CompletedTask;
    }
}

// Domain/Consent/ConsentRecord.cs
public record ConsentRecord
{
    public Guid     Id            { get; init; } = Guid.NewGuid();
    public string   PatientId     { get; init; } = default!;
    public string   PurposeCode   { get; init; } = default!;  // see ConsentPurpose
    public string   LegalBasis    { get; init; } = default!;  // GDPR Article 6/9 basis
    public bool     Granted       { get; init; }
    public DateTime GrantedAt     { get; init; }
    public DateTime? WithdrawnAt  { get; init; }
    public string   ConsentVersion{ get; init; } = default!;  // version of consent form
    public string   IpAddress     { get; init; } = default!;
    public string   CollectionMethod{ get; init; } = default!; // "web_form", "verbal", "paper"
    public DateTime ExpiresAt     { get; init; }               // consent has a time limit
}

public static class ConsentPurpose
{
    public const string TreatmentDelivery     = "treatment";          // Article 9(2)(h)
    public const string InsuranceBilling      = "billing";            // legitimate interest
    public const string ResearchAnonymised    = "research_anon";      // Article 9(2)(j)
    public const string MarketingEmails       = "marketing";          // explicit consent
    public const string AppointmentReminders  = "reminders";          // consent
    public const string DataSharing3rdParty   = "third_party_share";  // explicit consent
}

// Application/Consent/ConsentService.cs
public class ConsentService : IConsentService
{
    private readonly IConsentRepository _repo;
    private readonly IAuditService _audit;

    public async Task<bool> HasValidConsentAsync(
        string patientId,
        string purpose,
        CancellationToken ct = default)
    {
        var consent = await _repo.GetLatestAsync(patientId, purpose, ct);

        if (consent is null)
            return false;

        // Check not withdrawn
        if (consent.WithdrawnAt.HasValue)
            return false;

        // Check not expired (re-consent every 12 months for marketing)
        if (consent.ExpiresAt < DateTime.UtcNow)
            return false;

        return consent.Granted;
    }

    public async Task RecordConsentAsync(
        string patientId,
        string purpose,
        bool granted,
        string consentVersion,
        string collectionMethod,
        CancellationToken ct = default)
    {
        var record = new ConsentRecord
        {
            PatientId        = patientId,
            PurposeCode      = purpose,
            LegalBasis       = GetLegalBasis(purpose),
            Granted          = granted,
            GrantedAt        = DateTime.UtcNow,
            ConsentVersion   = consentVersion,
            CollectionMethod = collectionMethod,
            IpAddress        = GetCurrentIp(),
            ExpiresAt        = DateTime.UtcNow.AddYears(1),
        };

        await _repo.SaveAsync(record, ct);
        await _audit.LogPhiAccessAsync("ConsentRecord", record.Id.ToString(),
            patientId, granted ? "CONSENT_GRANTED" : "CONSENT_WITHDRAWN", true);
    }

    private static string GetLegalBasis(string purpose) => purpose switch
    {
        ConsentPurpose.TreatmentDelivery  => "Article 9(2)(h) - Medical treatment",
        ConsentPurpose.ResearchAnonymised => "Article 9(2)(j) - Public interest research",
        ConsentPurpose.MarketingEmails    => "Article 6(1)(a) - Explicit consent",
        _                                 => "Article 6(1)(a) - Explicit consent",
    };
}

// API/Middleware/ConsentGateMiddleware.cs
public class ConsentGateMiddleware
{
    private readonly RequestDelegate _next;

    // Endpoints that require marketing consent before proceeding
    private static readonly HashSet<string> _consentRequired = new(StringComparer.OrdinalIgnoreCase)
    {
        "/api/v1/patients/{id}/marketing-preferences",
        "/api/v1/newsletters/subscribe",
    };

    public async Task InvokeAsync(HttpContext context, IConsentService consent)
    {
        var path     = context.Request.Path.Value ?? "";
        var patientId = context.User.FindFirst("patient_id")?.Value;

        if (patientId != null && RequiresConsent(path))
        {
            var hasMktConsent = await consent.HasValidConsentAsync(
                patientId, ConsentPurpose.MarketingEmails);

            if (!hasMktConsent)
            {
                context.Response.StatusCode = 403;
                await context.Response.WriteAsJsonAsync(new
                {
                    error    = "consent_required",
                    message  = "Explicit consent required for this operation.",
                    purpose  = ConsentPurpose.MarketingEmails,
                    consentUrl = $"/patients/{patientId}/consent"
                });
                return;
            }
        }

        await _next(context);
    }
}

// Application/Gdpr/PatientErasureService.cs
public class PatientErasureService
{
    private readonly IPatientRepository   _patients;
    private readonly IAppointmentRepository _appointments;
    private readonly IAuditService        _audit;
    private readonly IConsentRepository   _consent;

    public async Task ProcessErasureRequestAsync(
        string patientId,
        string requestedBy,
        string legalJustification,
        CancellationToken ct = default)
    {
        // Step 1: Verify erasure is legally permissible
        // HIPAA: Cannot erase if within 6-year retention window
        var patient = await _patients.GetAsync(patientId, ct)
            ?? throw new PatientNotFoundException(patientId);

        if (patient.LastTreatmentDate > DateTime.UtcNow.AddYears(-6))
        {
            throw new ErasureNotPermittedException(
                "HIPAA requires retention for 6 years post-treatment. " +
                "We will anonymise non-clinical data and erase marketing data.");
        }

        // Step 2: Hard delete what we CAN delete (non-clinical, marketing)
        await _consent.DeleteAllForPatientAsync(patientId, ct);

        // Step 3: Anonymise what we must retain (clinical records)
        var anonymised = new PatientAnonymisedUpdate
        {
            FirstName    = "ANONYMISED",
            LastName     = "ANONYMISED",
            DateOfBirth  = new DateTime(1900, 1, 1),   // sentinel value
            Email        = $"erased_{Guid.NewGuid():N}@erased.invalid",
            Phone        = "0000000000",
            Address      = "ANONYMISED",
            Ssn          = null,
            IsErased     = true,
            ErasedAt     = DateTime.UtcNow,
            ErasureReason= legalJustification,
        };
        await _patients.AnonymiseAsync(patientId, anonymised, ct);

        // Step 4: Anonymise appointment records (keep clinical data, erase PII)
        await _appointments.AnonymisePatientDataAsync(patientId, ct);

        // Step 5: Mandatory audit entry (ironic but required — log that we erased)
        await _audit.LogPhiAccessAsync(
            "Patient", patientId, patientId,
            "ERASURE_COMPLETED", true, legalJustification);
    }
}

// Application/Gdpr/PatientDataExportService.cs
public class PatientDataExportService
{
    public async Task<PatientDataExport> GenerateExportAsync(
        string patientId,
        CancellationToken ct = default)
    {
        // Gather everything — patient is entitled to ALL their data
        var patient      = await _patients.GetAsync(patientId, ct);
        var appointments = await _appointments.GetAllForPatientAsync(patientId, ct);
        var consents     = await _consent.GetAllForPatientAsync(patientId, ct);
        var auditEntries = await _audit.GetPatientAccessLogAsync(patientId, ct);
        var documents    = await _documents.GetAllForPatientAsync(patientId, ct);

        var export = new PatientDataExport
        {
            ExportedAt  = DateTime.UtcNow,
            PatientId   = patientId,
            GeneratedBy = "automated_gdpr_system",
            DataVersion = "1.0",
            Profile = new PatientProfileExport
            {
                Name       = $"{patient.FirstName} {patient.LastName}",
                Email      = patient.Email,
                Phone      = patient.PhoneNumber,
                Address    = patient.HomeAddress,
                DateOfBirth= patient.DateOfBirth.ToString("yyyy-MM-dd"),
                RegisteredAt = patient.CreatedAt,
            },
            Appointments = appointments.Select(a => new AppointmentExport
            {
                Date     = a.ScheduledFor,
                Type     = a.Type,
                Clinic   = a.ClinicName,
                Status   = a.Status,
                Notes    = a.ClinicalNotes, // included only if patient requested full export
            }).ToList(),
            ConsentHistory = consents.Select(c => new ConsentExport
            {
                Purpose   = c.PurposeCode,
                Granted   = c.Granted,
                GrantedAt = c.GrantedAt,
                ExpiresAt = c.ExpiresAt,
                Withdrawn = c.WithdrawnAt,
            }).ToList(),
            DataAccessLog = auditEntries.Select(e => new AccessLogExport
            {
                AccessedBy = e.UserRole,    // role, not name, for staff privacy
                Action     = e.Action,
                At         = e.OccurredAt,
            }).ToList(),
        };

        // Produce JSON + PDF — GDPR requires machine-readable
        return export;
    }
}

// Application/DeIdentification/SafeHarborDeIdentifier.cs
public class SafeHarborDeIdentifier
{
    public DeIdentifiedAppointment DeIdentify(Appointment appointment)
    {
        return new DeIdentifiedAppointment
        {
            // Identifier removed
            // PatientId  = removed
            // PatientName = removed
            // PatientEmail = removed
            // PatientPhone = removed
            // PatientAddress = removed

            // Dates: truncate to year only (not month/day)
            AppointmentYear  = appointment.ScheduledFor.Year,
            BirthDecade      = (appointment.Patient.BirthYear / 10) * 10, // e.g. 1980

            // Geography: truncate zip to first 3 digits only
            ZipPrefix = appointment.Patient.ZipCode?[..3],

            // Keep clinical/operational data (not identifying)
            AppointmentType  = appointment.Type,
            Duration         = appointment.DurationMinutes,
            WasCompleted     = appointment.Status == AppointmentStatus.Completed,
            WasCancelled     = appointment.Status == AppointmentStatus.Cancelled,
            InsuranceType    = appointment.InsuranceCategory,  // not member ID
            ClinicState      = appointment.Clinic.State,        // not city/zip
        };
    }
}

# Python: anonymise a patient dataset with k-anonymity
# pip install anonymizedf

import pandas as pd
from anonymizedf.anonymizedf import anonymize

df = pd.read_sql("SELECT * FROM appointments JOIN patients...", conn)

an = anonymize(df)

# Suppress direct identifiers
an.fake_names("patient_name")
an.fake_ids("patient_id")
an.fake_emails("patient_email")

# Generalise quasi-identifiers (k-anonymity = 5 means
# at least 5 records share the same quasi-identifier combination)
an.fake_dates("date_of_birth", keep_year=True)
an.fake_categories("zip_code", generalize_to="zip_prefix_3")

anonymised_df = an.anonymize_data(k_level=5)

# Validate: no individual should be uniquely identifiable
assert anonymised_df.groupby(['birth_year','zip_prefix_3','gender']).size().min() >= 5

// Infrastructure/Security/BreachDetectionService.cs
public class BreachDetectionService : BackgroundService
{
    private readonly ILogger<BreachDetectionService> _log;
    private readonly IAuditRepository _audit;
    private readonly IBreachNotifier  _notifier;

    protected override async Task ExecuteAsync(CancellationToken ct)
    {
        while (!ct.IsCancellationRequested)
        {
            await DetectAnomaliesAsync(ct);
            await Task.Delay(TimeSpan.FromMinutes(5), ct);
        }
    }

    private async Task DetectAnomaliesAsync(CancellationToken ct)
    {
        var window = DateTime.UtcNow.AddHours(-1);

        // Rule 1: Bulk export anomaly — >50 patient records accessed in 1 hour
        var bulkAccess = await _audit.GetUsersExceedingAccessThresholdAsync(
            threshold: 50, since: window, ct: ct);

        foreach (var user in bulkAccess)
        {
            await _notifier.RaisePotentialBreachAsync(new BreachEvent
            {
                Type         = BreachType.UnusualBulkAccess,
                UserId       = user.UserId,
                AffectedCount= user.RecordCount,
                DetectedAt   = DateTime.UtcNow,
                Severity     = BreachSeverity.High,
                Description  = $"User {user.UserId} accessed {user.RecordCount} patient records in 1 hour",
            }, ct);
        }

        // Rule 2: Access outside business hours from new IP
        var afterHoursAccess = await _audit.GetAfterHoursAccessFromUnknownIpAsync(window, ct);
        foreach (var entry in afterHoursAccess)
        {
            await _notifier.RaisePotentialBreachAsync(new BreachEvent
            {
                Type      = BreachType.AfterHoursUnknownIp,
                UserId    = entry.UserId,
                IpAddress = entry.IpAddress,
                Severity  = BreachSeverity.Medium,
                Description = $"PHI accessed after hours from unrecognised IP {entry.IpAddress}",
            }, ct);
        }

        // Rule 3: Impossible travel — same user, 2 countries within 30 minutes
        var impossibleTravel = await _audit.GetImpossibleTravelEventsAsync(window, ct);
        foreach (var travel in impossibleTravel)
        {
            await _notifier.RaisePotentialBreachAsync(new BreachEvent
            {
                Type     = BreachType.ImpossibleTravel,
                UserId   = travel.UserId,
                Severity = BreachSeverity.Critical,
                Description = $"Impossible travel: {travel.Location1} → {travel.Location2} in {travel.MinutesBetween} min",
            }, ct);
        }
    }
}

// Infrastructure/Security/BreachNotifier.cs
public class BreachNotifier : IBreachNotifier
{
    private readonly ISnsClient       _sns;
    private readonly IBreachRepository _repo;

    public async Task RaisePotentialBreachAsync(BreachEvent breach, CancellationToken ct)
    {
        // 1. Persist the breach event
        await _repo.SaveAsync(breach, ct);

        // 2. Alert security team immediately (SNS → PagerDuty → phone call)
        if (breach.Severity >= BreachSeverity.High)
        {
            await _sns.PublishAsync(new PublishRequest
            {
                TopicArn = _securityAlertTopicArn,
                Subject  = $"[{breach.Severity}] Potential HIPAA Breach Detected",
                Message  = JsonSerializer.Serialize(breach),
            }, ct);
        }

        // 3. Start the GDPR 72-hour clock
        if (breach.Severity == BreachSeverity.Critical)
        {
            await _repo.StartGdprNotificationClockAsync(breach.Id, ct);
            // Automated reminder at 48h if not resolved
        }
    }
}

# modules/hipaa-rds/main.tf
resource "aws_db_instance" "main" {
  identifier     = var.identifier
  engine         = "postgres"
  engine_version = "16.2"
  instance_class = var.instance_class

  # HIPAA: encryption at rest mandatory
  storage_encrypted = true
  kms_key_id        = aws_kms_key.rds.arn

  # HIPAA: automated backups with 35-day retention
  backup_retention_period    = 35
  delete_automated_backups   = false
  deletion_protection        = true

  # HIPAA: no public access
  publicly_accessible = false
  db_subnet_group_name = aws_db_subnet_group.private.name

  # HIPAA: enhanced monitoring
  monitoring_interval = 60
  monitoring_role_arn = aws_iam_role.rds_monitoring.arn

  # HIPAA: enable performance insights
  performance_insights_enabled          = true
  performance_insights_retention_period = 731  # 2 years

  tags = {
    HIPAA = "true"
    PHI   = "true"
  }
}

resource "aws_kms_key" "rds" {
  description             = "RDS encryption key for PHI data"
  deletion_window_in_days = 30
  enable_key_rotation     = true   # HIPAA: rotate keys annually

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect    = "Allow"
        Principal = { AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root" }
        Action    = "kms:*"
        Resource  = "*"
      },
      {
        Effect    = "Deny"
        Principal = "*"
        Action    = ["kms:DisableKey", "kms:ScheduleKeyDeletion"]
        Resource  = "*"
        Condition = {
          StringNotEquals = {
            "aws:PrincipalArn" = var.kms_admin_role_arn
          }
        }
      }
    ]
  })
}

# S3: enforce encryption and block public access
resource "aws_s3_bucket" "phi_documents" {
  bucket = "${var.prefix}-phi-documents"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "phi" {
  bucket = aws_s3_bucket.phi_documents.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.s3.arn
    }
    bucket_key_enabled = true
  }
}

resource "aws_s3_bucket_public_access_block" "phi" {
  bucket                  = aws_s3_bucket.phi_documents.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

// API/Middleware/SessionTimeoutMiddleware.cs
public class SessionTimeoutMiddleware
{
    private readonly RequestDelegate _next;
    private static readonly TimeSpan PhiSessionTimeout = TimeSpan.FromMinutes(15);

    public async Task InvokeAsync(HttpContext context)
    {
        var lastActivity = context.Session.GetString("last_activity");

        if (lastActivity != null)
        {
            var lastTime = DateTime.Parse(lastActivity);
            if (DateTime.UtcNow - lastTime > PhiSessionTimeout)
            {
                // Session expired — invalidate JWT + redirect to login
                context.Response.Headers.Append("X-Session-Expired", "true");
                context.Response.StatusCode = 401;
                await context.Response.WriteAsJsonAsync(new
                {
                    error   = "session_expired",
                    message = "Your session has expired due to inactivity. Please log in again.",
                    timeout_minutes = PhiSessionTimeout.TotalMinutes
                });
                return;
            }
        }

        context.Session.SetString("last_activity", DateTime.UtcNow.ToString("O"));
        await _next(context);
    }
}