{
  "ok": true,
  "scope": "MaxArc Impact Platform - restricted patient locator and authorized search foundation (Task-006)",
  "notice": "Synthetic, non-identifiable sample data only. No real names, addresses, phone numbers, coordinates, or identifiable patient data. This is NOT a public locator, NOT a surveillance system, and NOT a full EHR. It demonstrates how authorized health personnel could locate continuity records across facilities while preserving consent, role-based access, minimum-necessary disclosure, auditability, and human oversight. Standalone-first with local sample data; separate from MaxTrax EHR and the Medical Library. AI is assistive only; no autonomous access, disclosure, or record merge.",
  "summary": {
    "totalLocatorRequests": 5,
    "approvedRestrictedSearches": 2,
    "deniedRequests": 2,
    "pendingSecondReview": 2,
    "consentExceptionsRequiringReview": 2,
    "highRiskAccessAttempts": 2,
    "possibleCrossFacilityMatches": 4,
    "unresolvedIdentityAmbiguity": 2,
    "disclosureEvents": 2,
    "openEscalations": 2,
    "auditCompletionRate": 100,
    "minimumNecessaryDisclosureEnforced": true,
    "aiRiskSignalCount": 4,
    "auditEventCount": 5,
    "decisionsByRole": {
      "tb-program-officer": 1,
      "hiv-continuity-nurse": 1,
      "field-outreach-worker": 1,
      "emergency-clinician": 1,
      "unverified-account": 1
    },
    "decisionsByPurpose": {
      "continuity-of-care": 2,
      "locate-for-outreach": 1,
      "emergency-care": 1,
      "bulk-lookup": 1
    },
    "boundaryReminder": {
      "impactDomain": "impact.maxarchealth.com",
      "impactPort": "3201",
      "medicalLibraryBoundary": "library.maxarchealth.com remains separate (port 3101, not used here)",
      "maxTraxEhrBoundary": "MaxTrax EHR remains separate; this is not a full EHR"
    }
  },
  "positioning": {
    "standaloneFirst": true,
    "integrationReady": true,
    "notAPublicLocator": true,
    "notASurveillanceSystem": true,
    "notAnEhr": true,
    "separateFromMaxTraxEhr": true,
    "linkedToPatientContinuity": true,
    "optionalIntegrations": [
      "EHR/MaxTrax",
      "Master Patient Index",
      "Consent Registry",
      "FHIR"
    ],
    "offlineCapable": true
  },
  "authorizationPosture": {
    "noPublicPatientSearch": true,
    "noAnonymousAccess": true,
    "noDirectPublicSearch": true,
    "authorizedRoleAndPurposeRequired": true,
    "minimumNecessaryDisclosureOnly": true,
    "consentOrLawfulAuthorityRequired": true,
    "highRiskRequestsRequireEscalation": true,
    "sensitiveRequestsRequireSecondApproval": true,
    "everyActionAuditable": true,
    "deniedRequestsDoNotRevealRecordExistence": true,
    "noPreciseLocationUnlessAuthorized": true,
    "emergencyAccessExceptionalDocumentedTimeLimitedAudited": true,
    "statement": "Access is never public or anonymous. An authorized role with a valid stated purpose and consent or documented lawful authority is required. Only the minimum-necessary result scope is disclosed. High-risk and sensitive requests require escalation and second approval. Denied requests never reveal whether a patient record exists. Precise location is never disclosed unless explicitly authorized. Emergency (break-glass) access is exceptional, documented, time-limited, and fully audited."
  },
  "privacyPosture": {
    "sampleDataSynthetic": true,
    "maskedPatientReferencesOnly": true,
    "noIdentifiableData": true,
    "dataRetention": "Locator request metadata retained for audit per policy; disclosed content minimized and time-limited. Synthetic retention windows shown for demonstration only.",
    "statement": "All patient references are masked synthetic tokens. No identifiable data is stored or disclosed. Retention is limited to auditable request metadata; disclosures are minimized and time-limited."
  },
  "aiPosture": {
    "statement": "AI supports restricted locator review: it scores identity-match confidence, surfaces likely cross-facility matches, detects duplicate/conflicting records, flags suspicious or excessive access, and recommends minimum-necessary scope. AI never approves access, discloses identity or location, overrides consent or law, reveals record existence after denial, merges records, or closes audit/compliance reviews on its own.",
    "assists": [
      "identify likely cross-facility matches",
      "score identity-match confidence",
      "detect duplicate or conflicting records",
      "flag suspicious access patterns",
      "identify excessive search behavior",
      "recommend minimum-necessary result scope",
      "support authorized reviewer triage"
    ],
    "mustNot": [
      "autonomously approve access",
      "autonomously disclose identity or location",
      "override consent or legal requirements",
      "reveal whether a record exists after denial",
      "autonomously merge patient records",
      "autonomously close audit or compliance reviews"
    ]
  },
  "humanControls": {
    "roles": [
      "facility-privacy-officer",
      "program-privacy-lead",
      "clinical-privacy-lead",
      "security-privacy-officer",
      "emergency-clinician",
      "oversight-reviewer",
      "auditor-read-only"
    ],
    "requirements": [
      "authorized role and valid stated purpose required for every request",
      "consent on file or documented lawful authority required before disclosure",
      "minimum-necessary disclosure enforced on every approval",
      "second approval required for sensitive/ambiguous requests",
      "escalation required for high-risk and emergency requests",
      "emergency break-glass access is time-limited and requires post-access review",
      "denied requests never reveal whether a record exists",
      "immutable audit trail for every request, decision, match, disclosure, denial, and override"
    ]
  },
  "boundary": {
    "impactDomain": "impact.maxarchealth.com",
    "impactPort": "3201",
    "medicalLibraryBoundary": "library.maxarchealth.com remains separate (port 3101, not used here)",
    "maxTraxEhrBoundary": "MaxTrax EHR remains separate; this is not a full EHR and does not couple repositories",
    "legacyRoute": "/restricted-locator-policies remains available and unchanged"
  },
  "routes": [
    "/restricted-patient-locator/requests",
    "/restricted-patient-locator/matches",
    "/restricted-patient-locator/access-decisions",
    "/restricted-patient-locator/consent-reviews",
    "/restricted-patient-locator/disclosures",
    "/restricted-patient-locator/denials",
    "/restricted-patient-locator/escalations",
    "/restricted-patient-locator/audit-events",
    "/restricted-patient-locator/risk-signals",
    "/restricted-patient-locator/summary",
    "/restricted-patient-locator-dashboard"
  ]
}