fix(rules): BAA-027 detect 'agrees to indemnify' & 'defend, indemnify and hold harmless' covered-entity indemnity forms (v1.1.0)

v1.0.0 required "covered entity (shall|will) indemnif" with the verb sitting
directly against the subject, catching only the barest form. It missed the
three phrasings real indemnity clauses use: the "agrees to indemnify" verb,
and the standard tripartite "shall defend, indemnify and hold harmless" /
"shall defend and indemnify" where the "defend," / "defend and" clause breaks
the adjacency. Split into a covered-entity branch (preserving the original
hookless breadth) and a customer/client branch (retaining the HIPAA/BA hook),
each broadened with the new verb set, an intervening defend/reimburse clause,
and a bare "hold harmless" grant. exclude_if keeps the compliant negated /
carved-out forms silent.

Probe: 5 fire cases (incl. 3 previously-missed phrasings), 4 silent cases
(each-party-responsible, negated, no-obligation, reversed BA-indemnity).
Finding-delta over the contracts corpus and the v3/v4 goldens shows zero
fired-flips and zero finding-count changes — the broadening adds no FPs.
Mirrors the DPA-048 v1.1.0 fix for the GDPR controller-indemnity twin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: clay-good

src/engine/rules/v3/baa/baa-ruleset.test.ts

@@ -487,3 +487,33 @@ describe("BAA-025 — HIPAA-remedy-impairing cap recognizes 'capped at / limited
     expect(await fires(b)).toBe(false);
   });
 });
+
+describe("BAA-027 — CE-indemnity recognizes 'agrees to' / defend-indemnify-hold-harmless forms (v1.1.0)", () => {
+  const fires = async (b: string) =>
+    (
+      await runEngine({
+        rules: BAA_RULES,
+        ctx: withBaa(buildContext(["BAA", b])),
+        source_file: SRC,
+      })
+    ).findings.some((f) => f.rule_id === "BAA-027");
+
+  it.each([
+    "Covered Entity shall indemnify Business Associate for any HIPAA violations.",
+    "Covered Entity agrees to indemnify Business Associate for any civil money penalties under HIPAA.",
+    "Covered Entity shall defend, indemnify and hold harmless Business Associate against all HIPAA claims.",
+    "Client agrees to indemnify and hold harmless Business Associate for any HIPAA penalties.",
+    "Covered Entity shall defend and indemnify Business Associate from and against all HIPAA fines.",
+  ])("fires on CE/customer indemnity of the BA: %s", async (b) => {
+    expect(await fires(b)).toBe(true);
+  });
+
+  it.each([
+    "Each party shall be responsible for its own violations of HIPAA.",
+    "Covered Entity shall not indemnify Business Associate for the Business Associate's own HIPAA violations.",
+    "Covered Entity shall have no obligation to indemnify Business Associate for HIPAA penalties.",
+    "Business Associate shall indemnify Covered Entity for any HIPAA violations caused by Business Associate.",
+  ])("stays silent on the compliant / negated / reversed form: %s", async (b) => {
+    expect(await fires(b)).toBe(false);
+  });
+});

src/engine/rules/v3/baa/rules.ts

@@ -552,6 +552,7 @@ export const BAA_RULES: Rule[] = [
 
   language({
     id: "BAA-027",
+    version: "1.1.0",
     name: "Covered entity indemnifies BA for HIPAA violations",
     description:
       "Flags clauses where the covered entity indemnifies the business associate for HIPAA violations — a common vendor overreach.",
@@ -563,9 +564,23 @@ export const BAA_RULES: Rule[] = [
       "HHS-frowned-upon drafting: shifting HIPAA liability from BA to the covered entity inverts the regulatory burden. The covered entity should not indemnify the BA for the BA's own HIPAA violations.",
     recommendation:
       "Restrict mutual indemnification to non-HIPAA matters, or remove the CE-to-BA indemnification entirely with respect to HIPAA breaches.",
+    // v1.0.0 required "covered entity (shall|will) indemnif" with the verb
+    // sitting DIRECTLY against the subject, so it caught only the barest form
+    // and missed the three phrasings real indemnity clauses use: the "agrees to
+    // indemnify" verb, and the standard tripartite "shall defend, indemnify and
+    // hold harmless" / "shall defend and indemnify" where the "defend," /
+    // "defend and" clause breaks the adjacency. Broaden the verb set, allow an
+    // intervening defend/reimburse clause, accept a bare "hold harmless" grant,
+    // and require the HIPAA hook so an ordinary non-HIPAA indemnity is not
+    // flagged. exclude_if keeps the compliant negated / carved-out forms silent.
     bad_patterns: [
-      /covered\s+entity\s+(shall|will)\s+indemnif/i,
-      /(customer|client)\s+(shall|will)\s+indemnif.*?HIPAA/i,
+      /covered\s+entity\s+(?:shall|will|must|agrees?\s+to)\s+(?:(?:defend|reimburse)\b[^.]{0,30})?(?:indemnif|hold\s+harmless)/i,
+      /(?:customer|client)\s+(?:shall|will|must|agrees?\s+to)\s+(?:(?:defend|reimburse)\b[^.]{0,30})?(?:indemnif|hold\s+harmless)[^.]{0,120}(?:HIPAA|PHI|civil\s+money\s+penalt|business\s+associate)/is,
+    ],
+    exclude_if: [
+      /\bnot\s+(?:be\s+)?(?:obligated|required|liable)\s+to\s+(?:defend|indemnif|hold)/i,
+      /\bno\s+(?:obligation|duty|liability)\s+to\s+(?:defend|indemnif|hold)/i,
+      /(?:shall|will|does|do|agrees?)\s+not\s+(?:defend|indemnif|hold)/i,
     ],
   }),