feat: Add Interactive HIPAA BAA Execution Engine, AWS Subcontractor Attestation & Instant BAA Contract PDF Export
This commit is contained in:
@@ -425,3 +425,290 @@ export function generateCourtDefensePdf(
|
||||
doc.save(`Certified_Court_Evidence_Record_${patient.lastName}_${soapNote.date}.pdf`);
|
||||
}
|
||||
|
||||
export interface HipaaBaaPdfData {
|
||||
tenant: {
|
||||
name: string;
|
||||
address: string;
|
||||
cityStateZip?: string;
|
||||
phone: string;
|
||||
email: string;
|
||||
taxId: string;
|
||||
npi: string;
|
||||
};
|
||||
signerName: string;
|
||||
signerTitle: string;
|
||||
signedAt: string;
|
||||
agreementId: string;
|
||||
verificationHash: string;
|
||||
}
|
||||
|
||||
export function generateHipaaBaaPdf(data: HipaaBaaPdfData) {
|
||||
const doc = new jsPDF({
|
||||
orientation: 'portrait',
|
||||
unit: 'pt',
|
||||
format: 'letter',
|
||||
});
|
||||
|
||||
const margin = 40;
|
||||
const pageWidth = doc.internal.pageSize.getWidth();
|
||||
|
||||
// ==================== PAGE 1 ====================
|
||||
let y = margin;
|
||||
|
||||
// Header Banner
|
||||
doc.setFillColor(15, 23, 42); // Slate 900
|
||||
doc.rect(0, 0, pageWidth, 85, 'F');
|
||||
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setTextColor(255, 255, 255);
|
||||
doc.setFontSize(15);
|
||||
doc.text('HIPAA BUSINESS ASSOCIATE AGREEMENT (BAA)', margin, 38);
|
||||
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(8.5);
|
||||
doc.setTextColor(148, 163, 184);
|
||||
doc.text(
|
||||
'STATUTORY COMPLIANCE INSTRUMENT PURSUANT TO 45 CFR PARTS 160 & 164 (PRIVACY, SECURITY & OMNIBUS RULES)',
|
||||
margin,
|
||||
54
|
||||
);
|
||||
doc.text(
|
||||
`AGREEMENT ID: ${data.agreementId} • EFFECTIVE DATE: ${data.signedAt.split('T')[0]}`,
|
||||
margin,
|
||||
68
|
||||
);
|
||||
|
||||
y = 105;
|
||||
|
||||
// Parties Box
|
||||
doc.setFillColor(248, 250, 252);
|
||||
doc.setDrawColor(203, 213, 225);
|
||||
doc.rect(margin, y, pageWidth - margin * 2, 75, 'FD');
|
||||
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9.5);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('COVERED ENTITY (THE CLIENT)', margin + 12, y + 16);
|
||||
doc.text('BUSINESS ASSOCIATE (THE PLATFORM)', 310, y + 16);
|
||||
|
||||
doc.setDrawColor(226, 232, 240);
|
||||
doc.line(margin + 12, y + 20, 290, y + 20);
|
||||
doc.line(310, y + 20, pageWidth - margin - 12, y + 20);
|
||||
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(8);
|
||||
doc.setTextColor(51, 65, 85);
|
||||
doc.text(`Entity: ${data.tenant.name}`, margin + 12, y + 33);
|
||||
doc.text(`Address: ${data.tenant.address}${data.tenant.cityStateZip ? `, ${data.tenant.cityStateZip}` : ''}`, margin + 12, y + 45);
|
||||
doc.text(`NPI: ${data.tenant.npi} | EIN / Tax ID: ${data.tenant.taxId}`, margin + 12, y + 57);
|
||||
doc.text(`Phone / Email: ${data.tenant.phone} | ${data.tenant.email}`, margin + 12, y + 69);
|
||||
|
||||
doc.text('Entity: AI Pilots LLC / Mediusa Clinical Systems', 310, y + 33);
|
||||
doc.text('Infrastructure: High-Security Cloud Clinical SaaS', 310, y + 45);
|
||||
doc.text('Email: hello@aipilots.site', 310, y + 57);
|
||||
doc.text('Governing Law: California, United States', 310, y + 69);
|
||||
|
||||
y += 90;
|
||||
|
||||
// Recitals
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('RECITALS & STATUTORY AUTHORITY', margin, y);
|
||||
doc.line(margin, y + 4, pageWidth - margin, y + 4);
|
||||
|
||||
y += 15;
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
const recitals =
|
||||
'This Business Associate Agreement ("BAA") supplements and forms an integral part of the service agreement between Covered Entity and Business Associate. Covered Entity is a covered healthcare provider under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), Public Law 104-191, the Health Information Technology for Economic and Clinical Health Act ("HITECH"), and their implementing regulations at 45 CFR Parts 160 and 164. Business Associate provides software services, electronic health records (EHR/SOAP), appointment scheduling, telehealth infrastructure, and billing tools that may involve the creation, receipt, maintenance, or transmission of electronic Protected Health Information ("ePHI").';
|
||||
const splitRecitals = doc.splitTextToSize(recitals, pageWidth - margin * 2);
|
||||
doc.text(splitRecitals, margin, y);
|
||||
y += splitRecitals.length * 9.5 + 8;
|
||||
|
||||
// Section 1: Permitted Uses and Disclosures
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('SECTION 1 — PERMITTED USES AND DISCLOSURES OF ePHI', margin, y);
|
||||
doc.line(margin, y + 4, pageWidth - margin, y + 4);
|
||||
|
||||
y += 15;
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
const sec1Text =
|
||||
'1.1 Service Provision: Business Associate is authorized to use and disclose ePHI solely as necessary to perform practice management services for Covered Entity, including appointment orchestration, clinical charting, diagnostic ICD-10 and CPT coding, billing statement generation, and patient communication.\n1.2 Nondisclosure: Business Associate will not use or disclose ePHI other than as permitted or required by this Agreement or as required by federal or state law.\n1.3 Prohibition on Sale of PHI: Business Associate expressly agrees never to sell, commercialize, license, or disclose Covered Entity’s ePHI for marketing, advertising, or third-party training without explicit authorization.';
|
||||
const splitSec1 = doc.splitTextToSize(sec1Text, pageWidth - margin * 2);
|
||||
doc.text(splitSec1, margin, y);
|
||||
y += splitSec1.length * 9.5 + 8;
|
||||
|
||||
// Section 2: Technical, Physical & Administrative Safeguards
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('SECTION 2 — TECHNICAL, PHYSICAL & ADMINISTRATIVE SAFEGUARDS (45 CFR § 164.312)', margin, y);
|
||||
doc.line(margin, y + 4, pageWidth - margin, y + 4);
|
||||
|
||||
y += 15;
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
const sec2Text =
|
||||
'2.1 Encryption at Rest: All electronic Protected Health Information stored in databases, storage volumes, and backups is encrypted using NIST-validated AES-256 encryption keys managed under strict cryptographic isolation.\n2.2 Encryption in Transit: All transmissions of ePHI across public or internal networks utilize Transport Layer Security (TLS) version 1.3 with Perfect Forward Secrecy.\n2.3 Role-Based Access Control (RBAC): Platform enforces granular access controls ensuring that front-desk and non-clinical personnel are programmatically restricted from accessing clinical SOAP narratives, physical examination records, or diagnostic codes.\n2.4 21 CFR Part 11 Audit Controls: System generates immutable, timestamped electronic audit trails tracking creation, amendment, signature, and export of medical encounters with SHA-256 digital seals.';
|
||||
const splitSec2 = doc.splitTextToSize(sec2Text, pageWidth - margin * 2);
|
||||
doc.text(splitSec2, margin, y);
|
||||
y += splitSec2.length * 9.5 + 8;
|
||||
|
||||
// Footer Page 1
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(148, 163, 184);
|
||||
doc.text('Mediusa Clinic OS • HIPAA Business Associate Agreement (BAA) • Page 1 of 2', margin, 760);
|
||||
|
||||
// ==================== PAGE 2 ====================
|
||||
doc.addPage();
|
||||
y = margin;
|
||||
|
||||
// Page 2 Header Banner
|
||||
doc.setFillColor(15, 23, 42);
|
||||
doc.rect(0, 0, pageWidth, 45, 'F');
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setTextColor(255, 255, 255);
|
||||
doc.setFontSize(11);
|
||||
doc.text('HIPAA BUSINESS ASSOCIATE AGREEMENT (BAA) — CONTINUED', margin, 28);
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(8);
|
||||
doc.setTextColor(148, 163, 184);
|
||||
doc.text(`AGREEMENT ID: ${data.agreementId}`, pageWidth - margin - 150, 28);
|
||||
|
||||
y = 65;
|
||||
|
||||
// Section 3: Downstream Subcontractor Pass-Through & Cloud Infrastructure Attestation
|
||||
doc.setFillColor(240, 249, 255); // Sky 50
|
||||
doc.setDrawColor(186, 230, 253); // Sky 200
|
||||
doc.rect(margin, y, pageWidth - margin * 2, 85, 'FD');
|
||||
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9);
|
||||
doc.setTextColor(3, 105, 161);
|
||||
doc.text('SECTION 3 — CLOUD INFRASTRUCTURE & SUBCONTRACTOR ATTESTATION', margin + 10, y + 15);
|
||||
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(12, 74, 110);
|
||||
const sec3Text =
|
||||
'3.1 Subcontractor BAA Compliance: Pursuant to 45 CFR § 164.504(e)(1)(ii), Business Associate warrants that any downstream subcontractor that creates, receives, maintains, or transmits ePHI on its behalf has entered into a binding written BAA.\n3.2 Certified Cloud Provider: Primary database and server compute workloads are provisioned on Amazon Web Services (AWS) under an active, executed AWS Artifact HIPAA Business Associate Addendum.\n3.3 Database Isolation: PostgreSQL cluster operates with automated AWS KMS AES-256 volume encryption, private subnet isolation, zero public endpoint exposure, and continuous automated backup snapshots.';
|
||||
const splitSec3 = doc.splitTextToSize(sec3Text, pageWidth - margin * 2 - 20);
|
||||
doc.text(splitSec3, margin + 10, y + 28);
|
||||
|
||||
y += 100;
|
||||
|
||||
// Section 4: Breach Notification Mandate
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('SECTION 4 — BREACH NOTIFICATION MANDATE (45 CFR § 164.410)', margin, y);
|
||||
doc.line(margin, y + 4, pageWidth - margin, y + 4);
|
||||
|
||||
y += 15;
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
const sec4Text =
|
||||
'4.1 Notice of Breach: Business Associate shall report to Covered Entity any confirmed Breach of Unsecured PHI without unreasonable delay and in no case later than ten (10) business days after discovery.\n4.2 Content of Notice: Such notice shall include, to the extent known: identification of affected individuals, description of nature of breach, types of ePHI involved, investigation results, and mitigation steps taken.';
|
||||
const splitSec4 = doc.splitTextToSize(sec4Text, pageWidth - margin * 2);
|
||||
doc.text(splitSec4, margin, y);
|
||||
y += splitSec4.length * 9.5 + 8;
|
||||
|
||||
// Section 5: Term, Termination & Data Disposition
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('SECTION 5 — TERM, TERMINATION & RETURN/DESTRUCTION OF ePHI', margin, y);
|
||||
doc.line(margin, y + 4, pageWidth - margin, y + 4);
|
||||
|
||||
y += 15;
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
const sec5Text =
|
||||
'5.1 Term: This Agreement shall be effective upon digital execution and remain in force throughout the term of Covered Entity’s active subscription.\n5.2 Disposition on Termination: Upon termination, Business Associate shall, upon written request, return or securely destroy all ePHI in accordance with NIST SP 800-88 Revision 1 guidelines for media sanitization.';
|
||||
const splitSec5 = doc.splitTextToSize(sec5Text, pageWidth - margin * 2);
|
||||
doc.text(splitSec5, margin, y);
|
||||
y += splitSec5.length * 9.5 + 16;
|
||||
|
||||
// Section 6: Signatures & Non-Repudiation Seal
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(9.5);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('SECTION 6 — MUTUAL EXECUTION & DIGITAL NON-REPUDIATION SEALS', margin, y);
|
||||
doc.line(margin, y + 4, pageWidth - margin, y + 4);
|
||||
|
||||
y += 16;
|
||||
|
||||
// Dual Signature Columns Box
|
||||
const sigBoxHeight = 110;
|
||||
doc.setFillColor(248, 250, 252);
|
||||
doc.setDrawColor(203, 213, 225);
|
||||
doc.rect(margin, y, pageWidth - margin * 2, sigBoxHeight, 'FD');
|
||||
|
||||
const colWidth = (pageWidth - margin * 2 - 20) / 2;
|
||||
|
||||
// Left Column: Business Associate
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(8.5);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('BUSINESS ASSOCIATE:', margin + 12, y + 16);
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
doc.text('Entity: AI Pilots LLC / Mediusa Clinical Systems', margin + 12, y + 28);
|
||||
doc.text('Signer: Chief Information Security Officer', margin + 12, y + 40);
|
||||
doc.text('Authorized Address: hello@aipilots.site', margin + 12, y + 52);
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setTextColor(5, 150, 105); // Emerald 600
|
||||
doc.text('STATUS: DIGITALLY COUNTERSIGNED & ACTIVE', margin + 12, y + 68);
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(6.5);
|
||||
doc.setTextColor(100, 116, 139);
|
||||
doc.text('System Enclave Seal: AI-PILOTS-BAA-KEY-2026', margin + 12, y + 80);
|
||||
|
||||
// Right Column: Covered Entity
|
||||
const rightColX = margin + colWidth + 20;
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setFontSize(8.5);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text('COVERED ENTITY (CLIENT):', rightColX, y + 16);
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7.5);
|
||||
doc.setTextColor(71, 85, 105);
|
||||
doc.text(`Entity: ${data.tenant.name}`, rightColX, y + 28);
|
||||
doc.text(`Signer: ${data.signerName} (${data.signerTitle})`, rightColX, y + 40);
|
||||
doc.text(`NPI: ${data.tenant.npi} | EIN: ${data.tenant.taxId}`, rightColX, y + 52);
|
||||
doc.setFont('helvetica', 'bold');
|
||||
doc.setTextColor(3, 105, 161); // Sky 700
|
||||
doc.text(`EXECUTED: ${data.signedAt}`, rightColX, y + 68);
|
||||
doc.setFont('courier', 'bold');
|
||||
doc.setFontSize(6.5);
|
||||
doc.setTextColor(15, 23, 42);
|
||||
doc.text(`SHA-256: ${data.verificationHash.replace('SHA-256: ', '').substring(0, 32)}...`, rightColX, y + 80);
|
||||
|
||||
y += sigBoxHeight + 14;
|
||||
|
||||
// Federal Legal Notice
|
||||
doc.setFont('helvetica', 'normal');
|
||||
doc.setFontSize(7);
|
||||
doc.setTextColor(148, 163, 184);
|
||||
doc.text(
|
||||
'This document constitutes a binding legal agreement enforceable under the Electronic Signatures in Global and National Commerce Act (ESIGN, 15 U.S.C. § 7001) and Uniform Electronic Transactions Act (UETA). Both parties retain cryptographic proof of execution.',
|
||||
margin,
|
||||
y
|
||||
);
|
||||
|
||||
// Footer Page 2
|
||||
doc.text('Mediusa Clinic OS • HIPAA Business Associate Agreement (BAA) • Page 2 of 2', margin, 760);
|
||||
|
||||
doc.save(`HIPAA_BAA_Agreement_${data.tenant.name.replace(/[^a-zA-Z0-9]/g, '_')}.pdf`);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user