How to Secure Go Microservices for HIPAA Compliance: A CTO's Guide

package security

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"io"
)

// EncryptionService handles encryption/decryption of PHI
type EncryptionService struct {
	key []byte
}

// NewEncryptionService creates a new encryption service
// Key should be 32 bytes for AES-256
func NewEncryptionService(key []byte) (*EncryptionService, error) {
	if len(key) != 32 {
		return nil, fmt.Errorf("key must be 32 bytes for AES-256")
	}
	return &EncryptionService{key: key}, nil
}

// EncryptPHI encrypts Protected Health Information
func (es *EncryptionService) EncryptPHI(plaintext string) (string, error) {
	block, err := aes.NewCipher(es.key)
	if err != nil {
		return "", err
	}

	// Use GCM mode for authenticated encryption
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}

	// Generate random nonce
	nonce := make([]byte, gcm.NonceSize())
	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
		return "", err
	}

	// Encrypt
	ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
	
	// Return base64 encoded ciphertext
	return base64.StdEncoding.EncodeToString(ciphertext), nil
}

// DecryptPHI decrypts Protected Health Information
func (es *EncryptionService) DecryptPHI(ciphertext string) (string, error) {
	block, err := aes.NewCipher(es.key)
	if err != nil {
		return "", err
	}

	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}

	// Decode base64
	data, err := base64.StdEncoding.DecodeString(ciphertext)
	if err != nil {
		return "", err
	}

	// Extract nonce
	nonceSize := gcm.NonceSize()
	if len(data) < nonceSize {
		return "", fmt.Errorf("ciphertext too short")
	}

	nonce, ciphertext := data[:nonceSize], data[nonceSize:]

	// Decrypt
	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		return "", err
	}

	return string(plaintext), nil
}

// Example usage
func ExampleEncryption() {
	// In production, load key from secure key management service (AWS KMS, HashiCorp Vault)
	key := make([]byte, 32)
	rand.Read(key)

	es, _ := NewEncryptionService(key)

	// Encrypt patient data
	phi := "John Doe, SSN: 123-45-6789, Diagnosis: Diabetes"
	encrypted, _ := es.EncryptPHI(phi)
	fmt.Println("Encrypted:", encrypted)

	// Decrypt
	decrypted, _ := es.DecryptPHI(encrypted)
	fmt.Println("Decrypted:", decrypted)
}

package audit

import (
	"context"
	"encoding/json"
	"fmt"
	"time"
)

// AuditEvent represents a HIPAA audit log entry
type AuditEvent struct {
	EventID       string    `json:"event_id"`
	Timestamp     time.Time `json:"timestamp"`
	UserID        string    `json:"user_id"`
	Action        string    `json:"action"` // READ, WRITE, DELETE, EXPORT
	ResourceType  string    `json:"resource_type"` // PATIENT, APPOINTMENT, etc.
	ResourceID    string    `json:"resource_id"`
	Status        string    `json:"status"` // SUCCESS, FAILURE
	IPAddress     string    `json:"ip_address"`
	UserAgent     string    `json:"user_agent"`
	Details       string    `json:"details"`
	ErrorMessage  string    `json:"error_message,omitempty"`
}

// AuditLogger handles HIPAA-compliant audit logging
type AuditLogger struct {
	// In production, use a secure, immutable audit log service
	// Examples: AWS CloudTrail, Splunk, ELK Stack
	logStore LogStore
}

// LogStore interface for different audit log backends
type LogStore interface {
	Store(ctx context.Context, event AuditEvent) error
	Query(ctx context.Context, userID string, startTime, endTime time.Time) ([]AuditEvent, error)
}

// NewAuditLogger creates a new audit logger
func NewAuditLogger(store LogStore) *AuditLogger {
	return &AuditLogger{logStore: store}
}

// LogAccess logs access to PHI
func (al *AuditLogger) LogAccess(ctx context.Context, userID, resourceType, resourceID, action string) error {
	event := AuditEvent{
		EventID:      generateEventID(),
		Timestamp:    time.Now().UTC(),
		UserID:       userID,
		Action:       action,
		ResourceType: resourceType,
		ResourceID:   resourceID,
		Status:       "SUCCESS",
		IPAddress:    extractIPFromContext(ctx),
		UserAgent:    extractUserAgentFromContext(ctx),
	}

	return al.logStore.Store(ctx, event)
}

// LogFailedAccess logs failed access attempts
func (al *AuditLogger) LogFailedAccess(ctx context.Context, userID, resourceType, reason string) error {
	event := AuditEvent{
		EventID:      generateEventID(),
		Timestamp:    time.Now().UTC(),
		UserID:       userID,
		Action:       "DENIED",
		ResourceType: resourceType,
		Status:       "FAILURE",
		IPAddress:    extractIPFromContext(ctx),
		ErrorMessage: reason,
	}

	return al.logStore.Store(ctx, event)
}

// LogDataExport logs when PHI is exported
func (al *AuditLogger) LogDataExport(ctx context.Context, userID, exportType string, recordCount int) error {
	event := AuditEvent{
		EventID:      generateEventID(),
		Timestamp:    time.Now().UTC(),
		UserID:       userID,
		Action:       "EXPORT",
		ResourceType: "PHI_EXPORT",
		Status:       "SUCCESS",
		IPAddress:    extractIPFromContext(ctx),
		Details:      fmt.Sprintf("Exported %d records as %s", recordCount, exportType),
	}

	return al.logStore.Store(ctx, event)
}

// QueryAuditLog queries audit logs for compliance review
func (al *AuditLogger) QueryAuditLog(ctx context.Context, userID string, days int) ([]AuditEvent, error) {
	endTime := time.Now().UTC()
	startTime := endTime.AddDate(0, 0, -days)

	return al.logStore.Query(ctx, userID, startTime, endTime)
}

// Helper functions
func generateEventID() string {
	return fmt.Sprintf("evt_%d", time.Now().UnixNano())
}

func extractIPFromContext(ctx context.Context) string {
	// Extract from request context
	if ip, ok := ctx.Value("client_ip").(string); ok {
		return ip
	}
	return "unknown"
}

func extractUserAgentFromContext(ctx context.Context) string {
	if ua, ok := ctx.Value("user_agent").(string); ok {
		return ua
	}
	return "unknown"
}

package auth

import (
	"context"
	"fmt"
	"net/http"
	"strings"
)

// Role-based access control for HIPAA
type Role string

const (
	RoleAdmin      Role = "admin"
	RolePhysician  Role = "physician"
	RoleNurse      Role = "nurse"
	RolePatient    Role = "patient"
	RoleAuditor    Role = "auditor"
)

// Permission defines what actions a role can perform
type Permission struct {
	Resource string // PATIENT, APPOINTMENT, BILLING
	Action   string // READ, WRITE, DELETE, EXPORT
}

// RolePermissions maps roles to permissions
var RolePermissions = map[Role][]Permission{
	RoleAdmin: {
		{Resource: "PATIENT", Action: "READ"},
		{Resource: "PATIENT", Action: "WRITE"},
		{Resource: "PATIENT", Action: "DELETE"},
		{Resource: "APPOINTMENT", Action: "READ"},
		{Resource: "APPOINTMENT", Action: "WRITE"},
		{Resource: "BILLING", Action: "READ"},
		{Resource: "BILLING", Action: "WRITE"},
	},
	RolePhysician: {
		{Resource: "PATIENT", Action: "READ"},
		{Resource: "PATIENT", Action: "WRITE"},
		{Resource: "APPOINTMENT", Action: "READ"},
		{Resource: "APPOINTMENT", Action: "WRITE"},
	},
	RoleNurse: {
		{Resource: "PATIENT", Action: "READ"},
		{Resource: "APPOINTMENT", Action: "READ"},
	},
	RolePatient: {
		{Resource: "PATIENT", Action: "READ"}, // Only own records
	},
	RoleAuditor: {
		{Resource: "AUDIT_LOG", Action: "READ"},
	},
}

// User represents an authenticated user
type User struct {
	ID    string
	Role  Role
	Email string
}

// AuthMiddleware validates JWT tokens and enforces HIPAA access control
func AuthMiddleware(next http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Extract JWT token from Authorization header
		authHeader := r.Header.Get("Authorization")
		if authHeader == "" {
			http.Error(w, "Missing authorization header", http.StatusUnauthorized)
			return
		}

		parts := strings.Split(authHeader, " ")
		if len(parts) != 2 || parts[0] != "Bearer" {
			http.Error(w, "Invalid authorization header", http.StatusUnauthorized)
			return
		}

		token := parts[1]

		// Validate token (use JWT library like github.com/golang-jwt/jwt)
		user, err := validateToken(token)
		if err != nil {
			http.Error(w, "Invalid token", http.StatusUnauthorized)
			return
		}

		// Add user to context
		ctx := context.WithValue(r.Context(), "user", user)
		next.ServeHTTP(w, r.WithContext(ctx))
	})
}

// RequirePermission middleware checks if user has required permission
func RequirePermission(resource, action string) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			user, ok := r.Context().Value("user").(*User)
			if !ok {
				http.Error(w, "User not found in context", http.StatusUnauthorized)
				return
			}

			// Check if user has permission
			if !hasPermission(user.Role, resource, action) {
				http.Error(w, "Insufficient permissions", http.StatusForbidden)
				return
			}

			next.ServeHTTP(w, r)
		})
	}
}

// hasPermission checks if a role has a specific permission
func hasPermission(role Role, resource, action string) bool {
	permissions, ok := RolePermissions[role]
	if !ok {
		return false
	}

	for _, perm := range permissions {
		if perm.Resource == resource && perm.Action == action {
			return true
		}
	}

	return false
}

// validateToken validates JWT token (simplified)
func validateToken(token string) (*User, error) {
	// In production, use proper JWT validation with secret key
	// This is a simplified example
	return &User{
		ID:    "user123",
		Role:  RolePhysician,
		Email: "[email protected]",
	}, nil
}

// Example usage
func ExampleAccessControl() {
	// Check if physician can read patient records
	if hasPermission(RolePhysician, "PATIENT", "READ") {
		fmt.Println("Physician can read patient records")
	}

	// Check if nurse can write patient records
	if !hasPermission(RoleNurse, "PATIENT", "WRITE") {
		fmt.Println("Nurse cannot write patient records")
	}
}

package models

import (
	"database/sql"
	"time"
)

// Patient represents a patient record with PHI
type Patient struct {
	ID           string    `db:"id"`
	FirstName    string    `db:"first_name"` // Encrypted
	LastName     string    `db:"last_name"`  // Encrypted
	SSN          string    `db:"ssn"`        // Encrypted
	DOB          time.Time `db:"dob"`        // Encrypted
	Email        string    `db:"email"`      // Encrypted
	Phone        string    `db:"phone"`      // Encrypted
	Address      string    `db:"address"`    // Encrypted
	CreatedAt    time.Time `db:"created_at"`
	UpdatedAt    time.Time `db:"updated_at"`
	DeletedAt    sql.NullTime `db:"deleted_at"` // Soft delete for audit trail
}

// PatientService handles patient data operations
type PatientService struct {
	db         *sql.DB
	encryption *EncryptionService
	auditLog   *AuditLogger
}

// GetPatient retrieves a patient record with access control
func (ps *PatientService) GetPatient(ctx context.Context, patientID string) (*Patient, error) {
	user, ok := ctx.Value("user").(*User)
	if !ok {
		return nil, fmt.Errorf("user not found in context")
	}

	// Check access control
	if !hasPermission(user.Role, "PATIENT", "READ") {
		// Log failed access attempt
		ps.auditLog.LogFailedAccess(ctx, user.ID, "PATIENT", "Insufficient permissions")
		return nil, fmt.Errorf("insufficient permissions")
	}

	// For patients, only allow access to own records
	if user.Role == RolePatient && user.ID != patientID {
		ps.auditLog.LogFailedAccess(ctx, user.ID, "PATIENT", "Attempting to access other patient's records")
		return nil, fmt.Errorf("cannot access other patient's records")
	}

	// Query database
	patient := &Patient{}
	err := ps.db.QueryRowContext(ctx, 
		"SELECT id, first_name, last_name, ssn, dob, email, phone, address, created_at, updated_at FROM patients WHERE id = $1 AND deleted_at IS NULL",
		patientID,
	).Scan(
		&patient.ID, &patient.FirstName, &patient.LastName, &patient.SSN,
		&patient.DOB, &patient.Email, &patient.Phone, &patient.Address,
		&patient.CreatedAt, &patient.UpdatedAt,
	)

	if err != nil {
		return nil, err
	}

	// Decrypt sensitive fields
	patient.FirstName, _ = ps.encryption.DecryptPHI(patient.FirstName)
	patient.LastName, _ = ps.encryption.DecryptPHI(patient.LastName)
	patient.SSN, _ = ps.encryption.DecryptPHI(patient.SSN)
	patient.Email, _ = ps.encryption.DecryptPHI(patient.Email)
	patient.Phone, _ = ps.encryption.DecryptPHI(patient.Phone)
	patient.Address, _ = ps.encryption.DecryptPHI(patient.Address)

	// Log access
	ps.auditLog.LogAccess(ctx, user.ID, "PATIENT", patientID, "READ")

	return patient, nil
}

// CreatePatient creates a new patient record
func (ps *PatientService) CreatePatient(ctx context.Context, patient *Patient) error {
	user, ok := ctx.Value("user").(*User)
	if !ok {
		return fmt.Errorf("user not found in context")
	}

	// Check access control
	if !hasPermission(user.Role, "PATIENT", "WRITE") {
		ps.auditLog.LogFailedAccess(ctx, user.ID, "PATIENT", "Insufficient permissions to create")
		return fmt.Errorf("insufficient permissions")
	}

	// Encrypt sensitive fields
	patient.FirstName, _ = ps.encryption.EncryptPHI(patient.FirstName)
	patient.LastName, _ = ps.encryption.EncryptPHI(patient.LastName)
	patient.SSN, _ = ps.encryption.EncryptPHI(patient.SSN)
	patient.Email, _ = ps.encryption.EncryptPHI(patient.Email)
	patient.Phone, _ = ps.encryption.EncryptPHI(patient.Phone)
	patient.Address, _ = ps.encryption.EncryptPHI(patient.Address)

	// Insert into database
	_, err := ps.db.ExecContext(ctx,
		"INSERT INTO patients (id, first_name, last_name, ssn, dob, email, phone, address, created_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
		patient.ID, patient.FirstName, patient.LastName, patient.SSN,
		patient.DOB, patient.Email, patient.Phone, patient.Address,
		time.Now(), time.Now(),
	)

	if err != nil {
		ps.auditLog.LogFailedAccess(ctx, user.ID, "PATIENT", fmt.Sprintf("Create failed: %v", err))
		return err
	}

	// Log successful creation
	ps.auditLog.LogAccess(ctx, user.ID, "PATIENT", patient.ID, "WRITE")

	return nil
}

// Use AWS KMS or HashiCorp Vault for key management
import "github.com/aws/aws-sdk-go/service/kms"

func getEncryptionKeyFromKMS(keyID string) ([]byte, error) {
	// Retrieve key from KMS instead of storing locally
	// This ensures keys are never exposed in code or logs
}