HIPAA Compliance Assessment Report

# meditrackpro/security/phi_encryption.py
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import boto3, os, base64, json

# AWS KMS — nunca almacenar la clave en BD junto al dato cifrado
kms_client = boto3.client('kms', region_name='us-west-2')
KMS_KEY_ID = os.environ['MEDITRACK_KMS_KEY_ID']

def encrypt_phi_field(plaintext: str) -> dict:
    """Cifra un campo PHI con AES-256-GCM usando clave de AWS KMS."""
    # Generar data key mediante KMS (envelope encryption)
    dk_response = kms_client.generate_data_key(
        KeyId=KMS_KEY_ID, KeySpec='AES_256'
    )
    plaintext_key = dk_response['Plaintext']       # usar y descartar
    encrypted_key = dk_response['CiphertextBlob']  # almacenar con el dato

    aesgcm = AESGCM(plaintext_key)
    nonce  = os.urandom(12)
    ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)

    return {
        "ciphertext": base64.b64encode(ciphertext).decode(),
        "nonce":      base64.b64encode(nonce).decode(),
        "enc_key":    base64.b64encode(encrypted_key).decode()
    }

def upload_dicom_encrypted(file_bytes: bytes, patient_id: str, study_uid: str):
    """Sube imagen DICOM a S3 con SSE-KMS obligatorio."""
    s3 = boto3.client('s3')
    s3.put_object(
        Bucket='meditrack-phi-dicom',
        Key=f"patients/{patient_id}/studies/{study_uid}.dcm",
        Body=file_bytes,
        ServerSideEncryption='aws:kms',
        SSEKMSKeyId=KMS_KEY_ID,
        Metadata={'patient_id': patient_id, 'phi': 'true'}
    )

# meditrackpro/security/audit_log.py
import json, hashlib, time
from datetime import datetime, timezone
import boto3

logs_client = boto3.client('logs', region_name='us-west-2')
LOG_GROUP  = '/meditrack/phi-audit'  # cifrado con KMS CMK
LOG_STREAM = f'phi-access-{datetime.now().strftime("%Y-%m")}'

def log_phi_access(
    user_id: str, action: str,
    resource_type: str, resource_id: str,
    patient_id: str, ip_address: str,
    success: bool, reason: str = None
) -> None:
    """Registra cada acceso a PHI con hash SHA-256 para integridad."""
    entry = {
        "timestamp":     datetime.now(timezone.utc).isoformat(),
        "user_id":       user_id,
        "action":        action,          # read | write | delete | export
        "resource_type": resource_type,   # patient_record | lab_result
        "resource_id":   resource_id,
        "patient_id":    patient_id,
        "ip_address":    ip_address,
        "success":       success,
        "reason":        reason,
        "log_version":   "1.0"
    }
    # SHA-256 del entry para detectar manipulación
    entry["hash"] = hashlib.sha256(
        json.dumps(entry, sort_keys=True).encode()
    ).hexdigest()

    logs_client.put_log_events(
        logGroupName=LOG_GROUP,
        logStreamName=LOG_STREAM,
        logEvents=[{
            'timestamp': int(time.time() * 1000),
            'message':   json.dumps(entry)
        }]
    )

# RETENCIÓN: 6 años = 2190 días (configurar en CloudWatch)
# aws logs put-retention-policy --log-group-name /meditrack/phi-audit \
#   --retention-in-days 2190

# meditrackpro/security/rbac.py
from enum import Enum
from functools import wraps

class Role(Enum):
    PHYSICIAN = "physician"
    NURSE     = "nurse"
    BILLING   = "billing"   # NUEVO: separar billing de clínico
    ADMIN     = "admin"
    PATIENT   = "patient"

# Mínimo privilegio: solo campos necesarios por rol
PHI_ACCESS_MATRIX = {
    Role.PHYSICIAN: {"diagnosis", "medications", "lab_results", "notes", "demographics"},
    Role.NURSE:     {"medications", "vitals", "allergies", "demographics"},
    Role.BILLING:   {"insurance_id", "diagnosis_codes", "demographics"},  # sin clínico
    Role.ADMIN:     {"demographics"},
    Role.PATIENT:   {"own_records_only"},
}

def require_phi_access(resource_type: str):
    def decorator(func):
        @wraps(func)
        def wrapper(request, *args, **kwargs):
            user_role = Role(request.user.role)
            allowed   = PHI_ACCESS_MATRIX.get(user_role, set())
            if resource_type not in allowed and "own_records_only" not in allowed:
                log_phi_access(request.user.id, "unauthorized_attempt",
                               resource_type, "", "", request.META["REMOTE_ADDR"], False)
                raise PermissionError(f"Rol {user_role.value} no puede acceder a {resource_type}")
            return func(request, *args, **kwargs)
        return wrapper
    return decorator

# Uso:
# @require_phi_access("lab_results")
# def get_lab_results(request, patient_id): ...