HIPAA Compliance Testing for Healthcare Apps: A Developer's Guide

# tests/hipaa/test_phi_access_controls.py

def test_phi_requires_authentication():
    """PHI endpoints must require authentication."""
    phi_endpoints = [
        "/api/patients",
        "/api/patients/123/records",
        "/api/prescriptions",
        "/api/lab-results",
    ]
    
    for endpoint in phi_endpoints:
        response = api_client.get(endpoint)  # No auth header
        assert response.status_code == 401, \
            f"{endpoint} returned {response.status_code} without authentication"

def test_phi_access_requires_role():
    """Only authorized roles can access PHI."""
    phi_endpoint = "/api/patients/123/medical-records"
    
    # Nurse should have access
    nurse_token = get_token(role="nurse")
    response = api_client.get(phi_endpoint, headers={"Authorization": f"Bearer {nurse_token}"})
    assert response.status_code == 200
    
    # Billing staff should not have access to medical records
    billing_token = get_token(role="billing")
    response = api_client.get(phi_endpoint, headers={"Authorization": f"Bearer {billing_token}"})
    assert response.status_code == 403, \
        "Billing role has unauthorized access to medical records"

def test_minimum_necessary_phi_exposure():
    """Each role should only see the minimum PHI necessary."""
    billing_token = get_token(role="billing")
    
    # Billing can see claims data
    claims_response = api_client.get(
        "/api/patients/123/claims",
        headers={"Authorization": f"Bearer {billing_token}"}
    )
    assert claims_response.status_code == 200
    
    claims = claims_response.json()
    
    # Billing claims should NOT include clinical notes
    for claim in claims:
        assert "clinical_notes" not in claim, "Clinical notes exposed to billing role"
        assert "diagnosis_details" not in claim, "Diagnosis details exposed to billing"

def test_automatic_session_timeout():
    """PHI sessions must timeout after inactivity (HIPAA requires auto-logoff)."""
    token = authenticate_user(username="nurse1", password="SecurePass!")
    
    # Make a request to confirm authenticated
    response = api_client.get("/api/patients", headers={"Authorization": f"Bearer {token}"})
    assert response.status_code == 200
    
    # Simulate inactivity timeout (in tests, we advance the clock)
    advance_clock(minutes=16)  # Beyond 15-minute timeout
    
    response = api_client.get("/api/patients", headers={"Authorization": f"Bearer {token}"})
    assert response.status_code == 401, "Session not terminated after inactivity"

def test_phi_encrypted_in_database():
    """PHI fields must be encrypted at rest in the database."""
    # Create a patient record
    patient = create_patient(
        name="Jane Patient",
        ssn="123-45-6789",
        diagnosis="Hypertension"
    )
    
    # Query the raw database (bypassing the application layer)
    raw_record = db.execute(
        "SELECT ssn, diagnosis FROM patients WHERE id = ?",
        (patient.id,)
    ).fetchone()
    
    # Values should be encrypted, not plaintext
    assert raw_record["ssn"] != "123-45-6789", \
        "SSN stored in plaintext"
    assert raw_record["diagnosis"] != "Hypertension", \
        "Diagnosis stored in plaintext"
    
    # Verify they're actually ciphertext
    assert len(raw_record["ssn"]) > 20, "SSN doesn't look encrypted"

def test_phi_not_in_application_logs():
    """PHI must never appear in application or error logs."""
    patient = create_patient(ssn="999-88-7777", name="Log Test Patient")
    
    # Trigger various operations
    api_client.get(f"/api/patients/{patient.id}")
    api_client.put(f"/api/patients/{patient.id}", json={"diagnosis": "Diabetes"})
    
    # Check logs
    logs = get_application_logs(minutes=5)
    
    phi_values = ["999-88-7777", "Log Test Patient", patient.id]
    
    for log_entry in logs:
        for phi_value in phi_values:
            assert phi_value not in log_entry.message, \
                f"PHI '{phi_value}' found in log: {log_entry.message}"

def test_phi_transmission_uses_tls():
    """All PHI transmission must be encrypted (TLS 1.2+)."""
    phi_endpoints = [
        "https://api.my-healthcare-app.com/patients",
        "https://api.my-healthcare-app.com/medical-records",
    ]
    
    for endpoint in phi_endpoints:
        tls_info = get_tls_info(endpoint)
        
        assert tls_info.version >= TLSVersion.TLS_1_2, \
            f"{endpoint} uses TLS {tls_info.version} (1.2+ required)"
        
        assert tls_info.cipher_suite not in WEAK_CIPHERS, \
            f"{endpoint} uses weak cipher: {tls_info.cipher_suite}"

def test_phi_access_creates_audit_log():
    """Every PHI access must create an audit log entry."""
    patient_id = "patient_123"
    nurse = authenticate_user(role="nurse")
    
    # Access PHI
    api_client.get(
        f"/api/patients/{patient_id}/medical-records",
        headers={"Authorization": f"Bearer {nurse.token}"}
    )
    
    # Verify audit log created
    audit_logs = get_audit_logs(resource_id=patient_id, minutes=1)
    
    assert len(audit_logs) >= 1, "No audit log created for PHI access"
    
    log = audit_logs[-1]
    assert log.user_id == nurse.id
    assert log.resource_type == "medical_records"
    assert log.resource_id == patient_id
    assert log.action == "read"
    assert log.timestamp is not None
    assert log.ip_address is not None

def test_phi_modification_audit_includes_changes():
    """PHI modification audit logs must include what changed."""
    patient_id = "patient_456"
    doctor = authenticate_user(role="doctor")
    
    # Modify PHI
    api_client.put(
        f"/api/patients/{patient_id}/diagnosis",
        headers={"Authorization": f"Bearer {doctor.token}"},
        json={"diagnosis": "Type 2 Diabetes", "medication": "Metformin"}
    )
    
    audit_logs = get_audit_logs(resource_id=patient_id, action="update", minutes=1)
    log = audit_logs[-1]
    
    assert log.action == "update"
    assert log.changed_fields is not None
    assert "diagnosis" in log.changed_fields
    assert log.previous_values is not None  # Must log what changed FROM

def test_audit_logs_are_tamper_evident():
    """Audit logs must be protected from modification."""
    # Attempt to delete an audit log entry
    audit_log_id = get_any_audit_log_id()
    
    response = db.execute(
        "DELETE FROM audit_logs WHERE id = ?",
        (audit_log_id,)
    )
    
    # If using tamper-evident logs (hash chains, write-once storage)
    # the deletion should either fail or be itself logged
    post_deletion_log = get_audit_logs(resource="audit_logs", action="delete", minutes=1)
    
    assert len(post_deletion_log) > 0, \
        "Audit log deletion not logged (tamper detection failed)"

def test_audit_logs_retained_for_six_years():
    """HIPAA requires 6-year audit log retention."""
    retention_policy = get_audit_log_retention_policy()
    
    assert retention_policy.retention_days >= 365 * 6, \
        f"Audit log retention is {retention_policy.retention_days} days (minimum 2190 required)"

def test_unusual_access_pattern_triggers_alert():
    """Bulk PHI access should trigger security alerts."""
    # Simulate an unusual access pattern (potential breach)
    user = authenticate_user(role="nurse")
    
    # Access 500 patient records in 5 minutes (unusual)
    for i in range(500):
        api_client.get(
            f"/api/patients/{i}/records",
            headers={"Authorization": f"Bearer {user.token}"}
        )
    
    # Verify alert was generated
    alerts = get_security_alerts(user_id=user.id, minutes=10)
    assert len(alerts) > 0, "No alert for unusual bulk PHI access"
    assert alerts[0].severity in ["high", "critical"]

def test_failed_authentication_lockout():
    """Multiple failed auth attempts must lock the account (prevent brute force)."""
    username = "test_nurse@hospital.com"
    
    for i in range(5):
        api_client.post("/api/auth/login", json={
            "username": username,
            "password": f"wrong_password_{i}"
        })
    
    # Account should now be locked
    response = api_client.post("/api/auth/login", json={
        "username": username,
        "password": "correct_password"
    })
    
    assert response.status_code == 423, \
        "Account not locked after multiple failed attempts"
    assert "locked" in response.json().get("message", "").lower()

def test_phi_access_restricted_to_agreed_purposes():
    """PHI must only be used for the purposes specified in the BAA."""
    baa = get_business_associate_agreement()
    
    # Verify your data uses match the BAA
    actual_purposes = get_phi_usage_purposes()
    
    for purpose in actual_purposes:
        assert purpose in baa.permitted_purposes, \
            f"PHI used for '{purpose}' which is not permitted by BAA"

def test_phi_not_shared_with_unauthorized_subcontractors():
    """PHI must not be shared with subcontractors without BAAs."""
    third_party_services = get_services_with_phi_access()
    baa_registry = get_baa_registry()
    
    for service in third_party_services:
        assert service.name in baa_registry, \
            f"{service.name} has PHI access but no BAA on file"
        assert baa_registry[service.name].status == "active"