# HIPAA Compliance Checklist for BeamScribe

This document outlines the changes required to make BeamScribe compliant with the Health Insurance Portability and Accountability Act (HIPAA) for handling Protected Health Information (PHI).

---

## 🔴 Critical Technical Requirements

### 1. Enable Encryption in Transit
**File:** `BeamScribe/Managers/MultipeerManager.swift`  
**Priority:** Critical  
**Effort:** Low

Change line 52 from:
```swift
session = MCSession(peer: peerID, securityIdentity: nil, encryptionPreference: .none)
```
To:
```swift
session = MCSession(peer: peerID, securityIdentity: nil, encryptionPreference: .required)
```

> [!CAUTION]
> Data transmitted between devices is currently **unencrypted**. Anyone within Bluetooth/Wi-Fi range could intercept transcript data.

---

### 2. Encrypt Transcripts at Rest
**File:** `BeamScribe/Managers/FileStorageManager.swift`  
**Priority:** Critical  
**Effort:** Medium

Currently, transcripts are stored as plain `.txt` files in the Documents directory. Changes needed:

- [ ] Use iOS Data Protection by setting file attributes:
  ```swift
  try data.write(to: fileURL, options: .completeFileProtection)
  ```
- [ ] Consider using CryptoKit (`AES.GCM`) for additional encryption layer
- [ ] Store encryption keys in Keychain with appropriate access controls

---

### 3. Prevent iCloud Backup of PHI
**File:** `BeamScribe/Managers/FileStorageManager.swift`  
**Priority:** Critical  
**Effort:** Low

Add after creating transcript files:
```swift
var resourceValues = URLResourceValues()
resourceValues.isExcludedFromBackup = true
try fileURL.setResourceValues(resourceValues)
```

> [!WARNING]
> Without this, transcripts containing PHI may be backed up to iCloud, which is not HIPAA-compliant unless you have a BAA with Apple.

---

### 4. Add Authentication to Access Transcripts
**Files:** New file + `BeamScribe/Views/HistoryView.swift`  
**Priority:** Critical  
**Effort:** Medium

- [ ] Create `AuthenticationManager.swift` using LocalAuthentication framework
- [ ] Require Face ID/Touch ID/Passcode before viewing History
- [ ] Add timeout that requires re-authentication after inactivity
- [ ] Provide fallback for devices without biometrics

---

## 🟡 Important Technical Requirements

### 5. Implement Audit Logging
**File:** New `BeamScribe/Managers/AuditLogManager.swift`  
**Priority:** High  
**Effort:** Medium

Create an audit log that records:
- [ ] When a transcript is created (timestamp, event name)
- [ ] When a transcript is viewed (timestamp, file name)
- [ ] When a transcript is exported/shared (timestamp, file name, export method)
- [ ] When a transcript is deleted (timestamp, file name)
- [ ] When a guest connects to receive transcript (timestamp, peer info)

Store logs securely with same encryption as transcripts.

---

### 6. Auto-Lock / Session Timeout
**File:** `BeamScribe/BeamScribeApp.swift` or `ContentView.swift`  
**Priority:** High  
**Effort:** Low

- [ ] Track time since last user interaction
- [ ] Auto-lock app and require re-authentication after 5 minutes of inactivity
- [ ] Clear sensitive data from memory on background

---

### 7. Secure Data Deletion
**File:** `BeamScribe/Managers/FileStorageManager.swift`  
**Priority:** High  
**Effort:** Low

When deleting transcripts:
- [ ] Overwrite file contents before deletion (secure wipe)
- [ ] Clear any cached copies
- [ ] Remove from UserDefaults if applicable

---

### 8. Minimum Necessary Access
**File:** Various  
**Priority:** Medium  
**Effort:** Medium

- [ ] Add option to disable transcript saving entirely (live view only mode)
- [ ] Add auto-delete policy (e.g., delete transcripts older than 30 days)
- [ ] Clear transcripts from guest devices when session ends (configurable)

---

## 🔵 Administrative Requirements

### 9. Update Privacy Policy
**File:** `privacy-policy.md`  
**Priority:** High  
**Effort:** Low

Add sections covering:
- [ ] HIPAA compliance statement
- [ ] How PHI is protected (encryption, access controls)
- [ ] Data retention and deletion policies
- [ ] User rights regarding their health information
- [ ] Breach notification procedures

---

### 10. User Consent Flow
**Files:** `BeamScribe/Views/OnboardingView.swift` or new consent view  
**Priority:** High  
**Effort:** Medium

- [ ] Display clear consent screen before first use
- [ ] Explain that app may record health-related conversations
- [ ] Require explicit "I Agree" action
- [ ] Store consent timestamp in audit log

---

### 11. Business Associate Agreement (BAA)
**Priority:** Critical (if using cloud speech recognition)  
**Effort:** External process

> [!IMPORTANT]
> If `requiresOnDeviceRecognition` is set to `false` (or not set), audio data may be sent to Apple's servers. You would need a BAA with Apple to remain HIPAA-compliant. Consider forcing on-device recognition for healthcare use.

**File:** `BeamScribe/Managers/TranscriptionManager.swift`

Check/add:
```swift
recognitionRequest.requiresOnDeviceRecognition = true
```

---

### 12. Incident Response Documentation
**File:** New `INCIDENT_RESPONSE.md`  
**Priority:** Medium  
**Effort:** Medium

Document procedures for:
- [ ] Identifying a potential breach
- [ ] Containing and investigating the breach
- [ ] Notifying affected individuals (within 60 days per HIPAA)
- [ ] Notifying HHS if breach affects 500+ individuals
- [ ] Documenting corrective actions

---

## Implementation Order (Recommended)

| Phase | Items | Effort |
|-------|-------|--------|
| **Phase 1** | #1 (Encryption in Transit), #3 (Backup Exclusion), #11 (On-device recognition) | Low |
| **Phase 2** | #2 (Encryption at Rest), #4 (Authentication) | Medium |
| **Phase 3** | #5 (Audit Logging), #6 (Auto-Lock), #7 (Secure Delete) | Medium |
| **Phase 4** | #9 (Privacy Policy), #10 (Consent Flow), #8 (Access Controls) | Medium |
| **Phase 5** | #12 (Incident Response) | Low |

---

## Additional Considerations

- **Apple BAA**: Apple offers a BAA for certain services. Review Apple's [Business Program](https://www.apple.com/business/compliance/) for healthcare compliance.
- **Penetration Testing**: Consider a security audit before deploying in healthcare settings.
- **Staff Training**: Document how healthcare staff should use the app to maintain compliance.
- **Regular Reviews**: HIPAA requires ongoing risk assessments; schedule quarterly reviews.

---

*Last Updated: December 26, 2025*