Security Implementation

SecureHealth implements comprehensive security measures to ensure HIPAA compliance and protect patient data. This guide covers the security patterns, implementations, and best practices used throughout the system.

Security Architecture Overview

Authentication Implementation

Session-Based Authentication

SecureHealth uses PHP sessions for authentication instead of JWT tokens. This provides better security for healthcare applications and integrates seamlessly with Symfony's security system.

Session-Based Authentication

Session Manager Service

SessionManager.php

<?php

namespace App\Security;

use Symfony\Component\HttpFoundation\Session\SessionInterface;
use App\Entity\User;

class SessionManager
{
    private SessionInterface $session;
    private int $sessionLifetime;

    public function __construct(SessionInterface $session, int $sessionLifetime = 1800)
    {
        $this->session = $session;
        $this->sessionLifetime = $sessionLifetime;
    }

    public function createSession(User $user): void
    {
        // Regenerate session ID for security
        $this->session->migrate(true);
        
        // Store user information in session
        $this->session->set('user_id', $user->getId());
        $this->session->set('user_email', $user->getEmail());
        $this->session->set('user_roles', $user->getRoles());
        $this->session->set('user_department', $user->getDepartment());
        $this->session->set('login_time', time());
        $this->session->set('last_activity', time());
        
        // Set session lifetime
        $this->session->set('session_lifetime', $this->sessionLifetime);
    }

    public function validateSession(): ?User
    {
        if (!$this->session->has('user_id')) {
            return null;
        }

        // Check session lifetime
        $lastActivity = $this->session->get('last_activity', 0);
        if (time() - $lastActivity > $this->sessionLifetime) {
            $this->destroySession();
            return null;
        }

        // Update last activity
        $this->session->set('last_activity', time());

        // Return user data from session
        return $this->getUserFromSession();
    }

    public function destroySession(): void
    {
        $this->session->invalidate();
    }

    public function refreshSession(): void
    {
        $this->session->migrate(true);
        $this->session->set('last_activity', time());
    }

    private function getUserFromSession(): ?User
    {
        if (!$this->session->has('user_id')) {
            return null;
        }

        // In a real implementation, you would fetch the user from the database
        // For this example, we'll create a basic user object from session data
        $user = new User();
        $user->setId($this->session->get('user_id'));
        $user->setEmail($this->session->get('user_email'));
        $user->setRoles($this->session->get('user_roles', []));
        $user->setDepartment($this->session->get('user_department'));

        return $user;
    }
}

Authentication Listener

SessionAuthenticationListener.php

<?php

namespace App\EventListener;

use App\Security\SessionManager;
use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\Security\Core\Exception\AuthenticationException;

class SessionAuthenticationListener
{
    private SessionManager $sessionManager;
    private array $publicRoutes;

    public function __construct(SessionManager $sessionManager, array $publicRoutes = [])
    {
        $this->sessionManager = $sessionManager;
        $this->publicRoutes = $publicRoutes;
    }

    public function onKernelRequest(RequestEvent $event): void
    {
        $request = $event->getRequest();
        
        // Skip authentication for public routes
        if (in_array($request->getPathInfo(), $this->publicRoutes)) {
            return;
        }

        // Skip authentication for non-API routes
        if (!str_starts_with($request->getPathInfo(), '/api/')) {
            return;
        }

        // Validate session
        $user = $this->sessionManager->validateSession();
        
        if (!$user) {
            $this->handleAuthenticationError($event, 'Session expired or invalid');
            return;
        }

        // Set user in request attributes
        $request->attributes->set('user', $user);
    }

    private function handleAuthenticationError(RequestEvent $event, string $message): void
    {
        $response = new JsonResponse([
            'error' => [
                'code' => 'AUTHENTICATION_REQUIRED',
                'message' => $message
            ]
        ], 401);

        $event->setResponse($response);
    }
}

Session Security Features

Session Security Implementation

• Session Regeneration: Session ID regenerated on login for security
• Session Timeout: Automatic session expiration after inactivity
• Secure Cookies: HTTP-only, secure, SameSite strict cookies
• Activity Tracking: Last activity timestamp for session validation
• Redis Storage: Sessions stored in Redis for scalability and security

Session Security Configuration

config/packages/framework.yaml

framework:
    session:
        handler_id: session.handler.redis
        cookie_secure: true
        cookie_httponly: true
        cookie_samesite: strict
        gc_maxlifetime: 1800
        gc_probability: 1
        gc_divisor: 1000
        name: SECUREHEALTH_SESSION

Session Security Service

SessionSecurityService.php

<?php

namespace App\Security;

use Symfony\Component\HttpFoundation\Session\SessionInterface;

class SessionSecurityService
{
    private SessionInterface $session;

    public function __construct(SessionInterface $session)
    {
        $this->session = $session;
    }

    public function validateSessionSecurity(): bool
    {
        // Check session age
        $loginTime = $this->session->get('login_time', 0);
        if (time() - $loginTime > 28800) { // 8 hours max
            return false;
        }

        // Check last activity
        $lastActivity = $this->session->get('last_activity', 0);
        if (time() - $lastActivity > 1800) { // 30 minutes
            return false;
        }

        // Check for session fixation
        if (!$this->session->has('session_regenerated')) {
            return false;
        }

        return true;
    }

    public function regenerateSessionId(): void
    {
        $this->session->migrate(true);
        $this->session->set('session_regenerated', true);
        $this->session->set('last_activity', time());
    }

    public function logSessionActivity(string $action): void
    {
        $activities = $this->session->get('session_activities', []);
        $activities[] = [
            'action' => $action,
            'timestamp' => time(),
            'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown'
        ];
        
        // Keep only last 10 activities
        $activities = array_slice($activities, -10);
        $this->session->set('session_activities', $activities);
    }
}

Authorization Implementation

Role-Based Access Control

Security Voter System

<?php

namespace App\Security\Voter;

use App\Entity\Patient;
use App\Entity\User;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Authorization\Voter\Voter;

class PatientVoter extends Voter
{
    const VIEW = 'view';
    const EDIT = 'edit';
    const DELETE = 'delete';
    const VIEW_MEDICAL = 'view_medical';
    const VIEW_INSURANCE = 'view_insurance';

    protected function supports(string $attribute, $subject): bool
    {
        return in_array($attribute, [self::VIEW, self::EDIT, self::DELETE, self::VIEW_MEDICAL, self::VIEW_INSURANCE])
            && $subject instanceof Patient;
    }

    protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
    {
        $user = $token->getUser();
        
        if (!$user instanceof User) {
            return false;
        }

        $patient = $subject;

        switch ($attribute) {
            case self::VIEW:
                return $this->canView($user, $patient);
            case self::EDIT:
                return $this->canEdit($user, $patient);
            case self::DELETE:
                return $this->canDelete($user, $patient);
            case self::VIEW_MEDICAL:
                return $this->canViewMedical($user, $patient);
            case self::VIEW_INSURANCE:
                return $this->canViewInsurance($user, $patient);
        }

        return false;
    }

    private function canView(User $user, Patient $patient): bool
    {
        // All authenticated users can view basic patient info
        return true;
    }

    private function canEdit(User $user, Patient $patient): bool
    {
        // Only doctors and admins can edit patient records
        return in_array('ROLE_DOCTOR', $user->getRoles()) || 
               in_array('ROLE_ADMIN', $user->getRoles());
    }

    private function canDelete(User $user, Patient $patient): bool
    {
        // Only admins can delete patients
        return in_array('ROLE_ADMIN', $user->getRoles());
    }

    private function canViewMedical(User $user, Patient $patient): bool
    {
        // Doctors, nurses, and admins can view medical data
        return in_array('ROLE_DOCTOR', $user->getRoles()) || 
               in_array('ROLE_NURSE', $user->getRoles()) ||
               in_array('ROLE_ADMIN', $user->getRoles());
    }

    private function canViewInsurance(User $user, Patient $patient): bool
    {
        // Doctors, receptionists, and admins can view insurance
        return in_array('ROLE_DOCTOR', $user->getRoles()) || 
               in_array('ROLE_RECEPTIONIST', $user->getRoles()) ||
               in_array('ROLE_ADMIN', $user->getRoles());
    }
}

Data Filtering Service

<?php

namespace App\Service;

use App\Entity\Patient;
use App\Entity\User;

class PatientDataFilter
{
    public function filterPatientData(Patient $patient, User $user): array
    {
        $baseData = [
            'id' => $patient->getId(),
            'patientId' => $patient->getPatientId(),
            'firstName' => $patient->getFirstName(),
            'lastName' => $patient->getLastName(),
            'dateOfBirth' => $patient->getDateOfBirth(),
        ];

        $role = $user->getRoles()[0];
        
        switch ($role) {
            case 'ROLE_ADMIN':
                return $this->getAdminData($patient, $baseData);
            case 'ROLE_DOCTOR':
                return $this->getDoctorData($patient, $baseData);
            case 'ROLE_NURSE':
                return $this->getNurseData($patient, $baseData);
            case 'ROLE_RECEPTIONIST':
                return $this->getReceptionistData($patient, $baseData);
            default:
                return $baseData;
        }
    }

    private function getAdminData(Patient $patient, array $baseData): array
    {
        return array_merge($baseData, [
            'medicalHistory' => $patient->getMedicalHistory(),
            'labResults' => $patient->getLabResults(),
            'prescriptions' => $patient->getPrescriptions(),
            'insurance' => $patient->getInsurance(),
            'auditLogs' => $patient->getAuditLogs()
        ]);
    }

    private function getDoctorData(Patient $patient, array $baseData): array
    {
        return array_merge($baseData, [
            'medicalHistory' => $patient->getMedicalHistory(),
            'labResults' => $patient->getLabResults(),
            'prescriptions' => $patient->getPrescriptions(),
            'insurance' => $patient->getInsurance()
        ]);
    }

    private function getNurseData(Patient $patient, array $baseData): array
    {
        return array_merge($baseData, [
            'medicalHistory' => $patient->getMedicalHistory(),
            'labResults' => $patient->getLabResults(),
            'prescriptions' => $patient->getPrescriptions()
        ]);
    }

    private function getReceptionistData(Patient $patient, array $baseData): array
    {
        return array_merge($baseData, [
            'insurance' => $patient->getInsurance(),
            'appointments' => $patient->getAppointments()
        ]);
    }
}

Encryption Implementation

MongoDB Queryable Encryption

Encryption Service

<?php

namespace App\Service;

use MongoDB\Client;
use MongoDB\Driver\Manager;
use MongoDB\Driver\BulkWrite;
use MongoDB\Driver\Query;

class MongoDBEncryptionService
{
    private Manager $manager;
    private array $encryptionSchema;
    private string $keyVaultNamespace;

    public function __construct(string $connectionString, array $encryptionSchema, string $keyVaultNamespace)
    {
        $this->encryptionSchema = $encryptionSchema;
        $this->keyVaultNamespace = $keyVaultNamespace;
        
        $this->manager = new Manager($connectionString, [
            'autoEncryption' => [
                'keyVaultNamespace' => $keyVaultNamespace,
                'kmsProviders' => [
                    'local' => [
                        'key' => base64_decode($_ENV['ENCRYPTION_MASTER_KEY'])
                    ]
                ],
                'schemaMap' => $encryptionSchema
            ]
        ]);
    }

    public function createPatient(array $patientData): string
    {
        $bulk = new BulkWrite();
        $bulk->insert($patientData);
        
        $result = $this->manager->executeBulkWrite('securehealth.patients', $bulk);
        
        return (string) $result->getInsertedIds()[0];
    }

    public function findPatient(string $patientId): ?array
    {
        $query = new Query(['patientId' => $patientId]);
        $cursor = $this->manager->executeQuery('securehealth.patients', $query);
        
        $results = $cursor->toArray();
        return empty($results) ? null : (array) $results[0];
    }

    public function searchPatients(array $criteria): array
    {
        $query = new Query($criteria);
        $cursor = $this->manager->executeQuery('securehealth.patients', $query);
        
        return array_map(function($document) {
            return (array) $document;
        }, $cursor->toArray());
    }

    public function updatePatient(string $patientId, array $updateData): bool
    {
        $bulk = new BulkWrite();
        $bulk->update(
            ['patientId' => $patientId],
            ['$set' => $updateData]
        );
        
        $result = $this->manager->executeBulkWrite('securehealth.patients', $bulk);
        
        return $result->getModifiedCount() > 0;
    }
}

Encryption Configuration

<?php

namespace App\Config;

class EncryptionConfig
{
    public static function getEncryptionSchema(): array
    {
        return [
            'securehealth.patients' => [
                'bsonType' => 'object',
                'encryptMetadata' => [
                    'keyId' => '/keyId',
                    'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
                ],
                'properties' => [
                    'patientId' => [
                        'encrypt' => [
                            'bsonType' => 'string',
                            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
                        ]
                    ],
                    'firstName' => [
                        'encrypt' => [
                            'bsonType' => 'string',
                            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
                        ]
                    ],
                    'lastName' => [
                        'encrypt' => [
                            'bsonType' => 'string',
                            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic'
                        ]
                    ],
                    'dateOfBirth' => [
                        'encrypt' => [
                            'bsonType' => 'date',
                            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'
                        ]
                    ],
                    'ssn' => [
                        'encrypt' => [
                            'bsonType' => 'string',
                            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'
                        ]
                    ],
                    'medicalHistory' => [
                        'encrypt' => [
                            'bsonType' => 'string',
                            'algorithm' => 'AEAD_AES_256_CBC_HMAC_SHA_512-Random'
                        ]
                    ]
                ]
            ]
        ];
    }
}

Audit Logging Implementation

Comprehensive Audit System

Audit Logger Service

<?php

namespace App\Service;

use App\Entity\AuditLog;
use App\Entity\User;
use Symfony\Component\HttpFoundation\Request;

class AuditLogger
{
    private $auditRepository;
    private $encryptionService;

    public function logAccess(User $user, string $action, $resource, Request $request, array $details = []): void
    {
        $auditLog = new AuditLog();
        
        // Basic information
        $auditLog->setUser($user);
        $auditLog->setAction($action);
        $auditLog->setTimestamp(new DateTime());
        
        // Resource information
        if ($resource) {
            $auditLog->setResourceType(get_class($resource));
            $auditLog->setResourceId($resource->getId());
            
            if (method_exists($resource, 'getPatientId')) {
                $auditLog->setPatientId($resource->getPatientId());
            }
        }
        
        // Request information
        $auditLog->setIpAddress($request->getClientIp());
        $auditLog->setUserAgent($request->headers->get('User-Agent'));
        $auditLog->setRequestMethod($request->getMethod());
        $auditLog->setRequestUrl($request->getUri());
        $auditLog->setSessionId($request->getSession()->getId());
        
        // Additional details
        $auditLog->setDetails($details);
        
        // Compliance information
        $auditLog->setHipaaCompliant(true);
        $auditLog->setAuditRequired(true);
        $auditLog->setRetentionPeriod('7_years');
        
        // Encrypt sensitive audit data
        $this->encryptAuditLog($auditLog);
        
        $this->auditRepository->save($auditLog);
    }

    public function logAuthentication(User $user, string $action, Request $request, bool $success, string $failureReason = null): void
    {
        $auditLog = new AuditLog();
        
        $auditLog->setUser($user);
        $auditLog->setAction($action);
        $auditLog->setTimestamp(new DateTime());
        $auditLog->setIpAddress($request->getClientIp());
        $auditLog->setUserAgent($request->headers->get('User-Agent'));
        $auditLog->setResult($success ? 'SUCCESS' : 'FAILURE');
        
        $details = [
            'success' => $success,
            'failureReason' => $failureReason,
            'loginMethod' => 'PASSWORD'
        ];
        
        $auditLog->setDetails($details);
        $auditLog->setHipaaCompliant(true);
        $auditLog->setAuditRequired(true);
        
        $this->auditRepository->save($auditLog);
    }

    private function encryptAuditLog(AuditLog $auditLog): void
    {
        // Encrypt sensitive fields in audit log
        if ($auditLog->getDetails()) {
            $encryptedDetails = $this->encryptionService->encrypt(json_encode($auditLog->getDetails()));
            $auditLog->setEncryptedDetails($encryptedDetails);
            $auditLog->setDetails(null); // Remove unencrypted data
        }
    }
}

Audit Event Listener

<?php

namespace App\EventListener;

use App\Service\AuditLogger;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\Security\Core\Event\AuthenticationEvent;
use Symfony\Component\Security\Core\Event\AuthenticationFailureEvent;

class AuditEventListener
{
    private AuditLogger $auditLogger;

    public function __construct(AuditLogger $auditLogger)
    {
        $this->auditLogger = $auditLogger;
    }

    public function onAuthenticationSuccess(AuthenticationEvent $event): void
    {
        $user = $event->getAuthenticationToken()->getUser();
        $request = $this->getCurrentRequest();
        
        if ($request) {
            $this->auditLogger->logAuthentication($user, 'LOGIN', $request, true);
        }
    }

    public function onAuthenticationFailure(AuthenticationFailureEvent $event): void
    {
        $token = $event->getAuthenticationToken();
        $user = $token->getUser();
        $request = $this->getCurrentRequest();
        
        if ($request && $user) {
            $this->auditLogger->logAuthentication($user, 'LOGIN_FAILED', $request, false, 'INVALID_CREDENTIALS');
        }
    }

    public function onKernelRequest(RequestEvent $event): void
    {
        $request = $event->getRequest();
        
        // Log API requests
        if (str_starts_with($request->getPathInfo(), '/api/')) {
            $this->logApiRequest($request);
        }
    }

    private function logApiRequest(Request $request): void
    {
        $user = $this->getCurrentUser();
        if (!$user) {
            return;
        }

        $action = $this->determineAction($request);
        $resource = $this->extractResource($request);
        
        $this->auditLogger->logAccess($user, $action, $resource, $request);
    }

    private function determineAction(Request $request): string
    {
        $method = $request->getMethod();
        $path = $request->getPathInfo();
        
        if (str_contains($path, '/patients')) {
            return match($method) {
                'GET' => 'VIEW_PATIENT',
                'POST' => 'CREATE_PATIENT',
                'PUT', 'PATCH' => 'UPDATE_PATIENT',
                'DELETE' => 'DELETE_PATIENT',
                default => 'UNKNOWN_ACTION'
            };
        }
        
        return 'UNKNOWN_ACTION';
    }
}

Security Monitoring

Real-time Security Monitoring

Security Monitor Service

SecurityMonitoringService.php

<?php

namespace App\Service;

class SecurityMonitoringService
{
    public function monitorSecurityEvents(): void
    {
        $this->monitorFailedLogins();
        $this->monitorSessionSecurity();
        $this->monitorPrivilegeEscalation();
        $this->monitorDataAccessPatterns();
        $this->monitorSuspiciousActivity();
    }

    private function monitorFailedLogins(): void
    {
        $recentFailures = $this->auditRepository->findRecentFailures(3600); // Last hour
        
        foreach ($recentFailures as $failure) {
            $failureCount = $this->auditRepository->countFailuresByUser($failure->getUser(), 3600);
            
            if ($failureCount > 5) {
                $this->triggerSecurityAlert('MULTIPLE_LOGIN_FAILURES', [
                    'user' => $failure->getUser(),
                    'failureCount' => $failureCount,
                    'timeframe' => '1_hour'
                ]);
            }
        }
    }

    private function monitorSessionSecurity(): void
    {
        $suspiciousSessions = $this->auditRepository->findSuspiciousSessions(3600);
        
        foreach ($suspiciousSessions as $session) {
            // Check for session hijacking attempts
            if ($this->detectSessionHijacking($session)) {
                $this->triggerSecurityAlert('SESSION_HIJACKING_ATTEMPT', [
                    'sessionId' => $session->getSessionId(),
                    'user' => $session->getUser(),
                    'ipAddress' => $session->getIpAddress(),
                    'timestamp' => $session->getTimestamp()
                ]);
            }

            // Check for excessive session creation
            $sessionCount = $this->auditRepository->countSessionsByUser($session->getUser(), 3600);
            if ($sessionCount > 10) {
                $this->triggerSecurityAlert('EXCESSIVE_SESSION_CREATION', [
                    'user' => $session->getUser(),
                    'sessionCount' => $sessionCount,
                    'timeframe' => '1_hour'
                ]);
            }
        }
    }

    private function detectSessionHijacking($session): bool
    {
        // Check for IP address changes
        $activities = $session->getSessionActivities();
        if (count($activities) > 1) {
            $ips = array_unique(array_column($activities, 'ip'));
            if (count($ips) > 1) {
                return true;
            }
        }

        // Check for unusual activity patterns
        $lastActivity = $session->getLastActivity();
        $currentTime = time();
        if ($currentTime - $lastActivity > 3600) { // 1 hour gap
            return true;
        }

        return false;
    }

    private function monitorPrivilegeEscalation(): void
    {
        $permissionChanges = $this->auditRepository->findRecentPermissionChanges(86400); // Last 24 hours
        
        foreach ($permissionChanges as $change) {
            $this->triggerSecurityAlert('PRIVILEGE_ESCALATION', [
                'user' => $change->getUser(),
                'oldRole' => $change->getDetails()['oldRole'],
                'newRole' => $change->getDetails()['newRole'],
                'timestamp' => $change->getTimestamp()
            ]);
        }
    }

    private function monitorDataAccessPatterns(): void
    {
        $recentAccess = $this->auditRepository->findRecentAccess(3600);
        
        $userAccessCounts = [];
        foreach ($recentAccess as $access) {
            $userId = $access->getUser()->getId();
            $userAccessCounts[$userId] = ($userAccessCounts[$userId] ?? 0) + 1;
        }
        
        foreach ($userAccessCounts as $userId => $count) {
            if ($count > 100) { // Threshold
                $this->triggerSecurityAlert('EXCESSIVE_DATA_ACCESS', [
                    'userId' => $userId,
                    'accessCount' => $count,
                    'timeframe' => '1_hour'
                ]);
            }
        }
    }

    private function monitorSuspiciousActivity(): void
    {
        // Monitor for unusual access patterns
        $unusualAccess = $this->auditRepository->findUnusualAccessPatterns(3600);
        
        foreach ($unusualAccess as $access) {
            $this->triggerSecurityAlert('SUSPICIOUS_ACTIVITY', [
                'user' => $access->getUser(),
                'activity' => $access->getAction(),
                'resource' => $access->getResourceType(),
                'timestamp' => $access->getTimestamp()
            ]);
        }
    }

    private function triggerSecurityAlert(string $type, array $details): void
    {
        $alert = new SecurityAlert();
        $alert->setType($type);
        $alert->setDetails($details);
        $alert->setTimestamp(new DateTime());
        $alert->setStatus('ACTIVE');
        
        $this->alertRepository->save($alert);
        
        // Send notification to security team
        $this->notificationService->sendSecurityAlert($alert);
    }
}

Input Validation and Sanitization

Request Validation

Validation Service

<?php

namespace App\Service;

use Symfony\Component\Validator\Validator\ValidatorInterface;
use Symfony\Component\Validator\Constraints as Assert;

class InputValidationService
{
    private ValidatorInterface $validator;

    public function __construct(ValidatorInterface $validator)
    {
        $this->validator = $validator;
    }

    public function validatePatientData(array $data): array
    {
        $constraints = new Assert\Collection([
            'firstName' => [
                new Assert\NotBlank(),
                new Assert\Length(['min' => 2, 'max' => 50]),
                new Assert\Regex(['pattern' => '/^[a-zA-Z\s]+$/'])
            ],
            'lastName' => [
                new Assert\NotBlank(),
                new Assert\Length(['min' => 2, 'max' => 50]),
                new Assert\Regex(['pattern' => '/^[a-zA-Z\s]+$/'])
            ],
            'dateOfBirth' => [
                new Assert\NotBlank(),
                new Assert\Date(),
                new Assert\LessThan('today')
            ],
            'email' => [
                new Assert\NotBlank(),
                new Assert\Email()
            ],
            'phone' => [
                new Assert\NotBlank(),
                new Assert\Regex(['pattern' => '/^\+?[1-9]\d{1,14}$/'])
            ],
            'ssn' => [
                new Assert\NotBlank(),
                new Assert\Regex(['pattern' => '/^\d{3}-\d{2}-\d{4}$/'])
            ]
        ]);

        $violations = $this->validator->validate($data, $constraints);
        
        $errors = [];
        foreach ($violations as $violation) {
            $errors[] = [
                'field' => $violation->getPropertyPath(),
                'message' => $violation->getMessage()
            ];
        }

        return $errors;
    }

    public function sanitizeInput(string $input): string
    {
        // Remove potentially dangerous characters
        $input = trim($input);
        $input = stripslashes($input);
        $input = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
        
        return $input;
    }
}

Security Best Practices

1. Authentication Security

• Strong Passwords: Enforce password complexity requirements
• Multi-Factor Authentication: Implement MFA for sensitive accounts
• Session Management: Implement secure session handling with Redis storage
• Session Security: Regenerate session IDs, implement timeouts, secure cookies
• Account Lockout: Lock accounts after failed login attempts
• Session Monitoring: Monitor for session hijacking and suspicious activity

2. Authorization Security

• Principle of Least Privilege: Grant minimum necessary access
• Role Separation: Separate administrative and clinical roles
• Regular Reviews: Periodically review user permissions
• Audit Access: Log all access control decisions

3. Data Security

• Encryption at Rest: Encrypt all sensitive data
• Encryption in Transit: Use HTTPS for all communications
• Key Management: Secure encryption key storage
• Data Minimization: Collect only necessary data

4. Application Security

• Input Validation: Validate all user inputs
• Output Encoding: Encode output to prevent XSS
• SQL Injection Prevention: Use parameterized queries
• CSRF Protection: Implement CSRF tokens

5. Monitoring and Compliance

• Real-time Monitoring: Continuous security monitoring
• Audit Logging: Comprehensive audit trail
• Incident Response: Implement incident response procedures
• Compliance Reporting: Generate compliance reports

Next Steps

• Testing - Testing strategies
• Deployment - Production deployment
• Tutorials - Step-by-step implementation guides
• Reference - Common issues and solutions