Variable: FATAL_CODES

const FATAL_CODES: object

Fatal codes - conditions that abort a de-identification pass by throwing a DeidError. The engine fails closed: it never silently degrades a fatal into a pass-through of PHI.

Type Declaration

DEID_CONTEXT_INVALID

readonly DEID_CONTEXT_INVALID: "DEID_CONTEXT_INVALID" = "DEID_CONTEXT_INVALID"

A DeidContext was configured with an invalid parameter that would silently weaken de-identification - most importantly a maxShiftDays that floors to 0, which pins every per-patient date-shift offset to zero, so a date-shift policy would emit the original real dates under a research label. A no-op shift is a leak, so the engine rejects the degenerate configuration at construction rather than silently shipping unshifted dates. The fatal set is additions-only.

DEID_NO_KEY

readonly DEID_NO_KEY: "DEID_NO_KEY" = "DEID_NO_KEY"

A keyed transform (pseudonymize / keyed-hash / date-shift) was required for a category present in the model, but no key (or, for date-shift, no per-patient scope) was supplied. The engine never falls back to an unkeyed transform - an unkeyed hash of an identifier is re-identifiable.

DEID_POLICY_INVALID

readonly DEID_POLICY_INVALID: "DEID_POLICY_INVALID" = "DEID_POLICY_INVALID"

A policy violates the key/label contract - most importantly, it applies the interval-preserving date-shift transform while carrying the reserved safe-harbor label. A shifted-but-real date is still "an element of a date" under §164.514(b)(2)(i)(C), so date-shift is an Expert-Determination technique, not Safe Harbor; labelling it safe-harbor would misrepresent the residual risk. The engine rejects it at point of use rather than silently emit shifted real dates under a Safe Harbor claim. The fatal set is additions-only.

DEID_PROFILE_INVALID

readonly DEID_PROFILE_INVALID: "DEID_PROFILE_INVALID" = "DEID_PROFILE_INVALID"

A DeidProfile spec violates the widen-never-narrow contract: a per-site profile derived from a base profile may only move a category to an equal-or-stronger transform (more removal, never less), and may never re-weaken a category the base scrubs. A profile that would reduce the de-identification strength of any category is rejected, so a site preset can only ever tighten - not quietly loosen - the base standard's protection. The fatal set is additions-only.

EMPTY_INPUT

readonly EMPTY_INPUT: "EMPTY_INPUT" = "EMPTY_INPUT"

The input model was null/undefined or carried no locus list - nothing to de-identify.

Example

import { FATAL_CODES } from "@cosyte/deid";

FATAL_CODES.DEID_NO_KEY; // => "DEID_NO_KEY"