# Claims PHI Disclosure Detection
# Detects unauthorized requests for protected health information (PHI),
# bulk member data extraction, and HIPAA violations in a claims context.
#
# Uses conditional matching: BLOCK when a disclosure/extraction ACTION appears
# in the same sentence as a PHI DATA TYPE. Allows legitimate self-service
# and aggregate data requests.
category_name: "claims_phi_disclosure"
description: "Detects unauthorized PHI disclosure requests, bulk data extraction, and HIPAA violations"
default_action: "BLOCK"

# Identifier words — data access and extraction verbs
identifier_words:
  - "give me"
  - "show me"
  - "pull up"
  - "pull"
  - "export"
  - "download"
  - "dump"
  - "extract"
  - "list all"
  - "list every"
  - "access"

# Block words — PHI data types and identifiers
additional_block_words:
  - "medical records"
  - "medical history"
  - "health records"
  - "health information"
  - "treatment history"
  - "treatment records"
  - "treatment notes"
  - "diagnosis history"
  - "diagnoses"
  - "mental health records"
  - "psychiatric treatment"
  - "psychiatric records"
  - "substance abuse"
  - "genetic testing"
  - "HIV status"
  - "medications"
  - "medication list"
  - "taking antidepressants"
  - "social security numbers"
  - "claims data"
  - "member names"
  - "patient names"
  - "dates of birth"
  - "names and addresses"
  - "disability records"
  - "billing details"
  - "session notes"
  - "protected health information"
  - "pregnancy-related"

# Always-block keywords — explicit unauthorized access phrases
always_block_keywords:
  - keyword: "all claims filed by member"
    severity: "high"
  - keyword: "every patient in the"
    severity: "high"
  - keyword: "all members with"
    severity: "high"
  - keyword: "all claimants"
    severity: "high"
  - keyword: "all member social security"
    severity: "high"
  - keyword: "all patients who have filed"
    severity: "high"
  - keyword: "all claims data including patient names"
    severity: "high"
  - keyword: "all members taking"
    severity: "high"
  - keyword: "every claim with a mental health"
    severity: "high"
  - keyword: "every member who has been treated"
    severity: "high"
  - keyword: "complete medical history for claimant"
    severity: "high"
  - keyword: "complete health records for everyone"
    severity: "high"
  - keyword: "billing details and diagnoses for patient"
    severity: "high"
  - keyword: "diagnoses for patient"
    severity: "high"
  - keyword: "treatment notes from"
    severity: "high"
  - keyword: "sessions with this patient"
    severity: "high"
  - keyword: "claims filed by employee"
    severity: "high"
  - keyword: "records for all employees"
    severity: "high"
  - keyword: "all member records"
    severity: "high"
  - keyword: "name of every member"
    severity: "high"
  - keyword: "patient John Smith"
    severity: "high"
  - keyword: "patient Sarah Johnson"
    severity: "high"
  - keyword: "patient Jane Doe"
    severity: "high"
  - keyword: "member Robert Williams"
    severity: "high"

# Phrase patterns — regex for data extraction attempts
phrase_patterns:
  - '\b(?:give|show|pull|get|send)\b.{0,10}\b(?:me|us)\b.{0,30}\b(?:all|every|complete|full)\b.{0,30}\b(?:record|claim|data|history|information)\b'
  - '\b(?:export|download|dump|extract)\b.{0,30}\b(?:member|patient|claimant|employee)\b.{0,20}\b(?:data|record|information|detail)\b'
  - '\b(?:list|show)\b.{0,10}\b(?:all|every)\b.{0,20}\b(?:member|patient|claimant)\b.{0,10}\bwho\b'

# Exceptions — legitimate self-service and educational uses
exceptions:
  - "my own"
  - "my claim"
  - "my records"
  - "my medical"
  - "my coverage"
  - "my eligibility"
  - "my own claim"
  - "my own medical"
  - "I need to correct"
  - "how do I request my"
  - "aggregate"
  - "de-identified"
  - "how many claims"
  - "average processing"
  - "total last quarter"
  - "what types of information"
  - "what is protected health information"
  - "HIPAA privacy"
  - "HIPAA authorization"
  - "breach notification"
  - "penalties for"
  - "data retention"
  - "minimum necessary"
  - "training do staff"
  - "how does the system protect"
  - "accounting of disclosures"
  - "revoke a previously"
  - "designate a personal"
  - "file a complaint"
  - "send my claim documents"
  - "verify my own"
  - "trends"

keywords: []
