Bot Detection for
Healthcare & Telehealth

const axios = require('axios');

async function checkPatientLoginRisk(ip, patientId) {
  const { data: risk } = await axios.get(
    `https://api.ipasis.com/check?ip=${ip}`,
    { headers: { 'X-API-Key': IPASIS_KEY } }
  );

  // Audit log (HIPAA: log access attempts)
  await auditLog({
    event: 'LOGIN_ATTEMPT',
    patientId,
    ip,
    riskLevel: risk.risk_level,
    ipType: risk.ip_type,
    timestamp: new Date().toISOString()
  });

  if (risk.trust_score < 20) {
    // Datacenter / Tor — likely automated
    return {
      action: 'BLOCK',
      reason: 'high_risk_infrastructure',
      requireMFA: true,
      alertSecurityTeam: true
    };
  }

  if (risk.is_proxy || risk.is_vpn) {
    // Anonymized — could be legitimate
    // but require additional verification
    return {
      action: 'STEP_UP',
      requireMFA: true,
      verifyIdentity: true
    };
  }

  if (risk.trust_score < 50) {
    return {
      action: 'ALLOW_WITH_MFA',
      requireMFA: true
    };
  }

  // Clean residential IP
  return { action: 'ALLOW' };
}