Chapter 2: Assessment & Data Security

2.1 Clinical Assessment Tools

Standardized clinical assessments are critical for establishing baseline symptom severity, tracking treatment progress, and demonstrating clinical efficacy. The WIA-MENTAL-001 standard mandates integration of validated assessment instruments that have undergone rigorous psychometric testing.

PHQ-9: Patient Health Questionnaire-9

The PHQ-9 is a nine-item depression screening instrument based directly on the nine diagnostic criteria for major depressive disorder in the DSM-5. It is one of the most widely used and validated depression screening tools worldwide.

Psychometric Properties: The PHQ-9 has demonstrated excellent internal reliability (Cronbach's alpha = 0.86-0.89) and strong criterion validity against structured clinical interviews. It has been validated across diverse populations, languages, and cultural contexts.

The Nine PHQ-9 Questions

Each question asks: "Over the last 2 weeks, how often have you been bothered by..." with response options: Not at all (0), Several days (1), More than half the days (2), Nearly every day (3).

1. Little interest or pleasure in doing things
2. Feeling down, depressed, or hopeless
3. Trouble falling or staying asleep, or sleeping too much
4. Feeling tired or having little energy
5. Poor appetite or overeating
6. Feeling bad about yourself - or that you are a failure or have let yourself or your family down
7. Trouble concentrating on things, such as reading the newspaper or watching television
8. Moving or speaking so slowly that other people could have noticed - or the opposite, being so fidgety or restless that you have been moving around a lot more than usual
9. Thoughts that you would be better off dead, or of hurting yourself in some way

GAD-7: Generalized Anxiety Disorder-7

The GAD-7 is a seven-item anxiety screening tool developed to identify probable cases of generalized anxiety disorder. Like the PHQ-9, it has excellent psychometric properties and is widely used in both clinical and research settings.

Digital Assessment Implementation

interface AssessmentEngine {
  // Administer assessment to patient
  runAssessment(
    type: 'PHQ-9' | 'GAD-7' | 'PCL-5' | 'SPIN',
    patientId: string,
    context: AssessmentContext
  ): Promise;
  
  // Score completed assessment
  scoreAssessment(
    responses: AssessmentResponse[]
  ): AssessmentScore;
  
  // Interpret score and provide clinical guidance
  interpretScore(
    score: number,
    type: AssessmentType,
    history?: AssessmentHistory
  ): ClinicalInterpretation;
  
  // Track changes over time
  trackTrend(
    patientId: string,
    assessmentType: AssessmentType,
    timeRange: DateRange
  ): Promise;
  
  // Generate safety alerts
  checkSafetyFlags(
    result: AssessmentResult
  ): SafetyAlert[];
}

interface AssessmentResult {
  id: string;
  patientId: string;
  assessmentType: AssessmentType;
  timestamp: Date;
  
  responses: {
    questionId: string;
    value: number;
    responseTime: number; // milliseconds
  }[];
  
  totalScore: number;
  severity: 'minimal' | 'mild' | 'moderate' | 
            'moderately-severe' | 'severe';
  
  interpretation: string;
  recommendations: string[];
  
  safetyFlags: {
    suicidalIdeation: boolean;
    selfHarm: boolean;
    requiresImmediateAttention: boolean;
  };
  
  comparisonToPrevious?: {
    previousScore: number;
    percentChange: number;
    trend: 'improving' | 'stable' | 'worsening';
  };
}

// Example: PHQ-9 scoring implementation
class PHQ9Scorer implements AssessmentScorer {
  score(responses: Response[]): AssessmentScore {
    if (responses.length !== 9) {
      throw new Error('PHQ-9 requires exactly 9 responses');
    }
    
    // Calculate total score (0-27)
    const totalScore = responses.reduce(
      (sum, r) => sum + r.value, 
      0
    );
    
    // Determine severity category
    let severity: Severity;
    if (totalScore <= 4) severity = 'minimal';
    else if (totalScore <= 9) severity = 'mild';
    else if (totalScore <= 14) severity = 'moderate';
    else if (totalScore <= 19) severity = 'moderately-severe';
    else severity = 'severe';
    
    // Check for suicidal ideation (question 9)
    const q9Response = responses[8].value;
    const suicidalIdeation = q9Response > 0;
    
    return {
      totalScore,
      severity,
      safetyFlags: {
        suicidalIdeation,
        requiresImmediateAttention: suicidalIdeation || totalScore >= 20
      },
      subscales: this.calculateSubscales(responses),
      reliability: this.checkReliability(responses)
    };
  }
  
  private calculateSubscales(responses: Response[]) {
    // PHQ-9 can be analyzed as two factors:
    // Somatic (questions 3, 4, 5, 8)
    // Cognitive-Affective (questions 1, 2, 6, 7, 9)
    
    const somatic = [2, 3, 4, 7].reduce(
      (sum, i) => sum + responses[i].value, 
      0
    );
    
    const cognitiveAffective = [0, 1, 5, 6, 8].reduce(
      (sum, i) => sum + responses[i].value, 
      0
    );
    
    return { somatic, cognitiveAffective };
  }
  
  private checkReliability(responses: Response[]): boolean {
    // Flag potentially invalid responses
    // e.g., all same value might indicate careless responding
    const values = responses.map(r => r.value);
    const allSame = values.every(v => v === values[0]);
    const tooFast = responses.every(r => r.responseTime < 1000);
    
    return !(allSame || tooFast);
  }
}

2.2 Database Architecture

The database schema must support secure storage of patient data, session information, assessment results, and progress metrics while maintaining HIPAA compliance and enabling efficient querying for clinical and research purposes.

Core Database Tables

The WIA-MENTAL-001 standard specifies a relational database design with clear separation between encrypted personal health information (PHI) and operational data.

-- Patients Table
CREATE TABLE patients (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMP NOT NULL DEFAULT NOW(),
  
  -- Demographics (encrypted)
  encrypted_demographics BYTEA NOT NULL,
  encryption_key_id VARCHAR(255) NOT NULL,
  
  -- Non-PHI operational data
  age_range VARCHAR(20), -- e.g., "25-34" for cohort analysis
  primary_concern VARCHAR(50),
  referral_source VARCHAR(50),
  
  -- Consent and status
  consent_status BOOLEAN DEFAULT FALSE,
  consent_date TIMESTAMP,
  active BOOLEAN DEFAULT TRUE,
  
  -- Audit fields
  created_by UUID,
  last_accessed TIMESTAMP,
  
  CONSTRAINT age_range_valid CHECK (
    age_range IN ('18-24', '25-34', '35-44', '45-54', 
                  '55-64', '65+')
  )
);

-- Therapy Sessions Table
CREATE TABLE therapy_sessions (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  patient_id UUID NOT NULL REFERENCES patients(id) ON DELETE CASCADE,
  therapist_id UUID REFERENCES therapists(id),
  
  -- Session metadata
  therapy_type VARCHAR(20) NOT NULL,
  module_id VARCHAR(100),
  status VARCHAR(20) NOT NULL,
  
  -- Timing
  start_time TIMESTAMP NOT NULL,
  end_time TIMESTAMP,
  duration_minutes INT,
  
  -- Session data (encrypted)
  encrypted_session_data BYTEA,
  encryption_key_id VARCHAR(255),
  
  -- Progress tracking
  completion_percentage DECIMAL(5,2),
  activities_completed INT DEFAULT 0,
  
  -- Audit
  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMP NOT NULL DEFAULT NOW(),
  
  CONSTRAINT valid_therapy_type CHECK (
    therapy_type IN ('CBT', 'DBT', 'ACT', 'IPT', 'MBCT')
  ),
  CONSTRAINT valid_status CHECK (
    status IN ('scheduled', 'in-progress', 'completed', 
               'cancelled', 'no-show')
  )
);

CREATE INDEX idx_sessions_patient ON therapy_sessions(patient_id);
CREATE INDEX idx_sessions_date ON therapy_sessions(start_time);
CREATE INDEX idx_sessions_status ON therapy_sessions(status);

-- Assessments Table
CREATE TABLE clinical_assessments (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  patient_id UUID NOT NULL REFERENCES patients(id) ON DELETE CASCADE,
  session_id UUID REFERENCES therapy_sessions(id),
  
  -- Assessment details
  assessment_type VARCHAR(20) NOT NULL,
  assessment_version VARCHAR(10) DEFAULT '1.0',
  
  -- Timing
  started_at TIMESTAMP NOT NULL,
  completed_at TIMESTAMP,
  duration_seconds INT,
  
  -- Results
  total_score INT NOT NULL,
  severity VARCHAR(30) NOT NULL,
  subscale_scores JSONB,
  
  -- Individual responses (for research, de-identified)
  responses JSONB NOT NULL,
  
  -- Safety flags
  safety_flags JSONB DEFAULT '{}',
  requires_immediate_attention BOOLEAN DEFAULT FALSE,
  
  -- Clinical notes
  interpretation TEXT,
  clinical_recommendations TEXT[],
  
  -- Validity checks
  completion_rate DECIMAL(5,2),
  reliability_flag BOOLEAN DEFAULT TRUE,
  
  -- Audit
  administered_by UUID,
  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
  
  CONSTRAINT valid_score_range CHECK (
    (assessment_type = 'PHQ-9' AND total_score BETWEEN 0 AND 27) OR
    (assessment_type = 'GAD-7' AND total_score BETWEEN 0 AND 21) OR
    (assessment_type = 'PCL-5' AND total_score BETWEEN 0 AND 80)
  )
);

CREATE INDEX idx_assessments_patient ON clinical_assessments(patient_id);
CREATE INDEX idx_assessments_type ON clinical_assessments(assessment_type);
CREATE INDEX idx_assessments_date ON clinical_assessments(completed_at);
CREATE INDEX idx_assessments_safety ON clinical_assessments(requires_immediate_attention)
  WHERE requires_immediate_attention = TRUE;

-- Progress Metrics Table
CREATE TABLE progress_metrics (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  patient_id UUID NOT NULL REFERENCES patients(id) ON DELETE CASCADE,
  session_id UUID REFERENCES therapy_sessions(id),
  
  -- Effectiveness measures
  symptom_improvement_score DECIMAL(5,2),
  engagement_score DECIMAL(5,2),
  homework_compliance_rate DECIMAL(5,2),
  
  -- Activity metrics
  time_spent_minutes INT,
  activities_completed INT,
  skills_practiced TEXT[],
  
  -- Behavioral activation
  pleasant_events_count INT DEFAULT 0,
  social_interactions_count INT DEFAULT 0,
  
  -- Self-reported measures
  subjective_wellbeing DECIMAL(3,1), -- 0-10 scale
  mood_rating DECIMAL(3,1), -- 0-10 scale
  
  -- Timestamp
  measurement_date DATE NOT NULL,
  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
  
  CONSTRAINT valid_scores CHECK (
    symptom_improvement_score BETWEEN -100 AND 100 AND
    engagement_score BETWEEN 0 AND 100 AND
    homework_compliance_rate BETWEEN 0 AND 100 AND
    subjective_wellbeing BETWEEN 0 AND 10 AND
    mood_rating BETWEEN 0 AND 10
  )
);

CREATE INDEX idx_metrics_patient ON progress_metrics(patient_id);
CREATE INDEX idx_metrics_date ON progress_metrics(measurement_date);

Data Encryption Strategy

Not all data requires the same level of protection. The WIA-MENTAL-001 standard employs a tiered encryption approach:

2.3 Session Management and State Persistence

Therapeutic interventions often span multiple sessions over weeks or months. Robust session management ensures continuity, tracks progress, and enables users to resume their work seamlessly.

interface SessionManager {
  // Create new therapy session
  createSession(config: SessionConfig): Promise;
  
  // Retrieve existing session
  getSession(sessionId: string): Promise;
  
  // Update session state
  updateSession(
    sessionId: string, 
    updates: Partial
  ): Promise;
  
  // Session lifecycle methods
  startSession(sessionId: string): Promise;
  pauseSession(sessionId: string): Promise;
  resumeSession(sessionId: string): Promise;
  completeSession(sessionId: string): Promise;
  
  // State persistence
  saveProgress(
    sessionId: string, 
    state: SessionState
  ): Promise;
  
  // Recovery mechanisms
  recoverSession(sessionId: string): Promise;
  cleanupExpiredSessions(): Promise;
}

interface SessionState {
  currentModuleId: string;
  currentActivityId: string;
  currentActivityIndex: number;
  
  completedActivities: string[];
  activityResponses: Map;
  
  userProgress: {
    overallCompletion: number; // percentage
    timeSpent: number; // minutes
    lastCheckpoint: Date;
  };
  
  patientState: {
    currentMood: number;
    energyLevel: number;
    concentration: number;
    notes: string;
  };
}