HIPAA Breach Case Studies & Lessons Learned

┌─────────────────────────────────────────────────────────────────┐
│                    BREACH ANATOMY                                │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  1. VULNERABILITY                                                │
│     └─► Technical flaw, policy gap, or human factor             │
│                                                                  │
│  2. THREAT ACTOR                                                 │
│     └─► External attacker, insider, or accidental               │
│                                                                  │
│  3. ATTACK VECTOR                                                │
│     └─► How the vulnerability was exploited                     │
│                                                                  │
│  4. BREACH                                                       │
│     └─► Unauthorized access, acquisition, or disclosure          │
│                                                                  │
│  5. DISCOVERY                                                    │
│     └─► How and when the organization learned of breach         │
│                                                                  │
│  6. RESPONSE                                                     │
│     └─► Containment, notification, and remediation              │
│                                                                  │
│  7. CONSEQUENCES                                                 │
│     └─► Regulatory penalties, lawsuits, reputation damage       │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

from dataclasses import dataclass, field
from typing import List, Optional
from datetime import date
from enum import Enum

class BreachType(Enum):
    HACKING = "Hacking/IT Incident"
    UNAUTHORIZED_ACCESS = "Unauthorized Access/Disclosure"
    THEFT = "Theft"
    LOSS = "Loss"
    IMPROPER_DISPOSAL = "Improper Disposal"
    OTHER = "Other"

class LocationType(Enum):
    NETWORK_SERVER = "Network Server"
    EMAIL = "Email"
    ELECTRONIC_MEDICAL_RECORD = "EMR"
    LAPTOP = "Laptop"
    DESKTOP = "Desktop"
    PAPER = "Paper/Films"
    PORTABLE_DEVICE = "Portable Device"
    OTHER = "Other"

class RootCause(Enum):
    MISSING_ENCRYPTION = "Missing Encryption"
    WEAK_ACCESS_CONTROLS = "Weak Access Controls"
    PHISHING = "Phishing/Social Engineering"
    UNPATCHED_SYSTEMS = "Unpatched Systems"
    INSIDER_THREAT = "Insider Threat"
    MISCONFIGURATION = "Misconfiguration"
    MISSING_BAA = "Missing Business Associate Agreement"
    INADEQUATE_TRAINING = "Inadequate Training"
    PHYSICAL_SECURITY = "Physical Security Failure"

@dataclass
class CaseStudy:
    """Template for analyzing HIPAA breach cases"""
    
    # Basic Information
    organization_name: str
    organization_type: str  # Hospital, Clinic, BA, Health Plan
    breach_date: date
    discovery_date: date
    notification_date: date
    resolution_date: Optional[date]
    
    # Breach Details
    breach_type: BreachType
    location_types: List[LocationType]
    individuals_affected: int
    phi_types_exposed: List[str]
    
    # Root Cause Analysis
    primary_root_cause: RootCause
    secondary_causes: List[RootCause] = field(default_factory=list)
    vulnerability_description: str = ""
    attack_description: str = ""
    
    # Response Assessment
    discovery_method: str = ""  # How was breach discovered?
    time_to_discover_days: int = 0
    time_to_notify_days: int = 0
    immediate_actions: List[str] = field(default_factory=list)
    long_term_remediation: List[str] = field(default_factory=list)
    
    # Enforcement Outcome
    ocr_investigation: bool = False
    settlement_amount: float = 0.0
    corrective_action_plan: bool = False
    cap_duration_years: int = 0
    
    # Lessons
    key_lessons: List[str] = field(default_factory=list)
    prevention_controls: List[str] = field(default_factory=list)
    
    def calculate_cost_per_record(self) -> float:
        """Calculate settlement cost per affected individual"""
        if self.individuals_affected > 0:
            return self.settlement_amount / self.individuals_affected
        return 0.0
    
    def assess_response_quality(self) -> str:
        """Evaluate the organization's response"""
        issues = []
        
        if self.time_to_discover_days > 30:
            issues.append("Slow discovery (>30 days)")
        if self.time_to_notify_days > 60:
            issues.append("Notification beyond HIPAA deadline")
        if not self.immediate_actions:
            issues.append("No documented immediate response")
        
        if len(issues) == 0:
            return "GOOD - Timely discovery and notification"
        elif len(issues) == 1:
            return f"FAIR - {issues[0]}"
        else:
            return f"POOR - Multiple issues: {', '.join(issues)}"
    
    def generate_summary(self) -> str:
        """Generate case study summary"""
        return f"""
CASE STUDY: {self.organization_name}
{'=' * 50}

OVERVIEW
--------
Organization Type: {self.organization_type}
Breach Date: {self.breach_date}
Individuals Affected: {self.individuals_affected:,}
Settlement Amount: ${self.settlement_amount:,.0f}
Cost Per Record: ${self.calculate_cost_per_record():.2f}

WHAT HAPPENED
-------------
Type: {self.breach_type.value}
Location: {', '.join([l.value for l in self.location_types])}

Root Cause: {self.primary_root_cause.value}
{self.vulnerability_description}

PHI Exposed: {', '.join(self.phi_types_exposed)}

RESPONSE ASSESSMENT
-------------------
Discovery Method: {self.discovery_method}
Time to Discover: {self.time_to_discover_days} days
Time to Notify: {self.time_to_notify_days} days
Response Quality: {self.assess_response_quality()}

KEY LESSONS
-----------
{chr(10).join('• ' + lesson for lesson in self.key_lessons)}

PREVENTION CONTROLS
-------------------
{chr(10).join('• ' + control for control in self.prevention_controls)}
"""

from collections import Counter
from typing import List, Dict

class BreachPatternAnalysis:
    """Analyze patterns across HIPAA breaches"""
    
    def __init__(self, cases: List[CaseStudy]):
        self.cases = cases
    
    def root_cause_frequency(self) -> Dict[RootCause, int]:
        """Identify most common root causes"""
        causes = [case.primary_root_cause for case in self.cases]
        return dict(Counter(causes).most_common())
    
    def average_dwell_time(self) -> float:
        """Calculate average time to detect breach"""
        times = [case.time_to_discover_days for case in self.cases]
        return sum(times) / len(times) if times else 0
    
    def cost_correlation(self) -> Dict[str, float]:
        """Correlate factors with settlement amounts"""
        return {
            "avg_cost_per_record": self._avg_cost_per_record(),
            "correlation_dwell_time": self._correlate_dwell_settlement(),
            "correlation_records": self._correlate_volume_settlement()
        }
    
    def _avg_cost_per_record(self) -> float:
        costs = [case.calculate_cost_per_record() for case in self.cases]
        return sum(costs) / len(costs) if costs else 0

Hospital/Health System     ████████████████████  45%
Business Associate         ██████████████        30%
Health Plan               ████████               15%
Healthcare Provider        ████                   8%
Other                      █                      2%