<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use Illuminate\Support\Facades\DB;
use App\Models\SelfPaced\Course;
use App\Models\SelfPaced\CourseCategory;
use App\Models\SelfPaced\CourseTopic;
use App\Models\SelfPaced\CourseSubTopic;
use App\Models\SelfPaced\ExamQuestion;
use App\Models\SelfPaced\CourseDownload;
use App\Models\User;

/**
 * EthicsDataProtectionCourseSeeder
 *
 * Seeds the "Professional Certificate in Ethics and Data Protection in Health Systems"
 * with 7 topics, 4 subtopics each (28 total), 35 exam questions, and 2 downloads.
 * All fees in South Sudanese Pound (SSP). Fully idempotent via firstOrCreate.
 *
 * Run individually:
 *   php artisan db:seed --class=EthicsDataProtectionCourseSeeder
 *
 * Requirements: 2.1-2.12, 3.1-3.5, 4.1-4.6, 5.1-5.9, 6.1-6.6, 7.1-7.5, 10.1-10.4
 */
class EthicsDataProtectionCourseSeeder extends Seeder
{
    private int $createdById  = 1;
    private int $instructorId = 1;

    public function run(): void
    {
        DB::transaction(function () {
            $this->resolveUsers();
            $course = $this->makeCourse();
            $this->seedTopics($course);
            $this->seedQuestions($course);
            $this->seedDownloads($course);
        });

        $this->command->info('EthicsDataProtectionCourseSeeder: course seeded successfully.');
    }

    private function resolveUsers(): void
    {
        $admin   = User::whereHas('roles', fn ($q) => $q->where('name', 'Super Manager'))->first();
        $trainer = User::whereHas('roles', fn ($q) => $q->where('name', 'Trainers'))->first();
        $this->createdById  = $admin?->id ?? 1;
        $this->instructorId = $trainer?->id ?? $admin?->id ?? 1;
    }

    private function makeCourse(): Course
    {
        $category = CourseCategory::where('slug', 'ethics-law')->first();

        return Course::firstOrCreate(
            ['slug' => 'professional-certificate-ethics-data-protection-health'],
            [
                'title'                      => 'Professional Certificate in Ethics and Data Protection in Health Systems',
                'description'                => 'This Professional Certificate equips health professionals in South Sudan with the ethical reasoning skills and legal knowledge needed to navigate complex ethical dilemmas in clinical practice, research, and health data management. Participants will explore foundational health ethics principles, patient rights, research ethics, data privacy law, and governance frameworks, with a focus on the South Sudan health context. The course prepares graduates to uphold the highest ethical standards in their professional practice.',
                'objectives'                 => "By the end of this course, participants will be able to:\n- Apply core bioethical principles to clinical and public health practice\n- Protect patient rights and obtain valid informed consent\n- Navigate research ethics requirements including IRB processes\n- Implement data privacy and protection measures in health systems\n- Interpret legal frameworks governing health data in South Sudan\n- Apply ethical decision-making frameworks to complex clinical dilemmas\n- Understand whistleblowing obligations and accountability mechanisms\n- Promote a culture of ethical practice in health organisations",
                'prerequisites'              => 'Basic understanding of health service delivery or public health. Experience working in a clinical, research, or health management role is recommended. No prior ethics or legal training is required.',
                'category_id'                => $category?->id,
                'instructor_id'              => $this->instructorId,
                'fee_amount'                 => 75000.00,
                'currency'                   => 'SSP',
                'duration_hours'             => 35,
                'passing_score'              => 70,
                'exam_attempts_allowed'      => 3,
                'exam_time_limit'            => 90,
                'exam_questions_per_attempt' => 20,
                'status'                     => 'published',
                'created_by'                 => $this->createdById,
                'updated_by'                 => $this->createdById,
            ]
        );
    }

    private function makeTopic(Course $course, string $title, string $description, int $order): CourseTopic
    {
        return CourseTopic::firstOrCreate(
            ['course_id' => $course->id, 'title' => $title],
            ['description' => $description, 'sort_order' => $order, 'is_published' => true]
        );
    }

    private function makeSub(CourseTopic $topic, string $title, string $html, int $order): void
    {
        CourseSubTopic::firstOrCreate(
            ['topic_id' => $topic->id, 'title' => $title],
            ['content' => $html, 'sort_order' => $order, 'is_published' => true]
        );
    }

    private function makeQuestion(Course $course, array $q, int $order): void
    {
        ExamQuestion::firstOrCreate(
            ['course_id' => $course->id, 'question_text' => $q['question']],
            [
                'option_a'               => $q['a'],
                'option_b'               => $q['b'],
                'option_c'               => $q['c'],
                'option_d'               => $q['d'],
                'correct_answer'         => $q['answer'],
                'explanation'            => $q['explanation'],
                'allow_multiple_answers' => false,
                'correct_answers_json'   => null,
                'sort_order'             => $order,
                'is_active'              => true,
            ]
        );
    }

    private function makeDownload(Course $course, string $title, string $fileName, string $mimeType, int $fileSize): void
    {
        $slug = $course->slug;
        CourseDownload::firstOrCreate(
            ['course_id' => $course->id, 'title' => $title],
            [
                'topic_id'  => null,
                'file_path' => "downloads/courses/{$slug}/{$fileName}",
                'file_name' => $fileName,
                'file_size' => $fileSize,
                'mime_type' => $mimeType,
            ]
        );
    }

    private function seedTopics(Course $course): void
    {
        $this->seedTopic1($course);
        $this->seedTopic2($course);
        $this->seedTopic3($course);
        $this->seedTopic4($course);
        $this->seedTopic5($course);
        $this->seedTopic6($course);
        $this->seedTopic7($course);
    }

    // =========================================================================
    // TOPIC 1 — Foundations of Health Ethics
    // =========================================================================
    private function seedTopic1(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Foundations of Health Ethics',
            'Core bioethical principles, theories, and their application to health practice in South Sudan.',
            1
        );

        $this->makeSub($topic, 'Introduction to Bioethics',
            '<h3>What is Bioethics?</h3><p>Bioethics is the study of ethical issues arising from advances in biology, medicine, and health care. It draws on philosophy, law, theology, and social science to address questions about what is right and wrong in health care and research. In South Sudan, bioethics is particularly important given the complex ethical challenges arising from resource scarcity, cultural diversity, conflict, and the intersection of traditional practices with modern medicine.</p><h3>Why Ethics Matters in Health</h3><p>Ethical practice is fundamental to health care for several reasons:</p><ul><li><strong>Trust:</strong> Patients must trust health workers to act in their best interests. Ethical breaches destroy this trust and undermine health-seeking behaviour.</li><li><strong>Dignity:</strong> Every patient has inherent dignity that must be respected regardless of their health condition, social status, or ability to pay.</li><li><strong>Justice:</strong> Health resources must be allocated fairly, with particular attention to the needs of the most vulnerable.</li><li><strong>Accountability:</strong> Health professionals are accountable to their patients, their profession, and society for the ethical quality of their practice.</li></ul><p>In South Sudan, where health workers often face extreme resource constraints and difficult working conditions, maintaining ethical standards requires both individual commitment and supportive organisational systems and policies.</p>',
        1);

        $this->makeSub($topic, 'The Four Principles of Bioethics',
            '<h3>Beauchamp and Childress\'s Four Principles</h3><p>The four principles framework, developed by Tom Beauchamp and James Childress, is the most widely used approach to bioethical analysis in health care. The four principles are:</p><ul><li><strong>Autonomy:</strong> Respect for the patient\'s right to make informed decisions about their own health care. Autonomy requires that patients receive adequate information, understand it, and make decisions free from coercion. In South Sudan, autonomy must be understood in the context of collectivist cultural values where family and community play important roles in health decisions.</li><li><strong>Beneficence:</strong> The obligation to act in the patient\'s best interests and to promote their wellbeing. Health workers must use their knowledge and skills to benefit patients.</li><li><strong>Non-maleficence:</strong> The obligation to avoid causing harm. This principle is captured in the ancient medical maxim "primum non nocere" (first, do no harm). Health workers must weigh the potential benefits and harms of every intervention.</li><li><strong>Justice:</strong> The fair distribution of health benefits and burdens. Justice requires that health resources are allocated equitably and that vulnerable populations receive special protection.</li></ul><h3>Applying the Four Principles in South Sudan</h3><p>Applying the four principles in South Sudan requires sensitivity to local cultural, social, and economic contexts. For example, the principle of autonomy must be balanced against collectivist decision-making norms; beneficence must be pursued within the constraints of extreme resource scarcity; and justice requires addressing the profound health inequities that characterise South Sudan\'s health system.</p>',
        2);

        $this->makeSub($topic, 'Ethical Theories in Health Care',
            '<h3>Major Ethical Theories</h3><p>Several ethical theories provide frameworks for moral reasoning in health care. Understanding these theories helps health professionals analyse complex ethical situations from multiple perspectives:</p><ul><li><strong>Consequentialism (Utilitarianism):</strong> Actions are judged by their consequences. The right action is the one that produces the greatest good for the greatest number. In public health, utilitarian reasoning often guides resource allocation decisions (e.g., prioritising interventions that save the most lives).</li><li><strong>Deontology:</strong> Actions are judged by whether they conform to moral rules or duties, regardless of consequences. Deontological ethics emphasises duties such as truth-telling, promise-keeping, and respect for persons. The prohibition on lying to patients, even when the truth is painful, reflects deontological reasoning.</li><li><strong>Virtue Ethics:</strong> Focuses on the character of the moral agent rather than rules or consequences. Virtue ethics asks: what would a person of good character do? Virtues relevant to health care include compassion, honesty, integrity, and prudence.</li><li><strong>Care Ethics:</strong> Emphasises relationships, context, and the importance of caring for particular individuals. Care ethics is particularly relevant to nursing and community health practice.</li></ul><p>In practice, health professionals draw on multiple ethical theories when analysing complex situations. No single theory provides all the answers, and ethical wisdom involves knowing when to apply which framework.</p>',
        3);

        $this->makeSub($topic, 'Cultural and Religious Dimensions of Health Ethics in South Sudan',
            '<h3>Cultural Context of Health Ethics</h3><p>South Sudan is a culturally diverse country with over 60 ethnic groups, each with distinct cultural values, beliefs, and practices that influence health behaviour and ethical decision-making. Health professionals must understand and respect this cultural diversity while upholding universal ethical principles.</p><p>Key cultural dimensions relevant to health ethics in South Sudan include:</p><ul><li><strong>Collectivism:</strong> In many South Sudanese cultures, health decisions are made collectively by families and communities rather than by individuals alone. This has implications for informed consent and patient autonomy.</li><li><strong>Gender roles:</strong> Traditional gender roles may affect women\'s ability to make autonomous health decisions, particularly regarding reproductive health.</li><li><strong>Traditional medicine:</strong> Many South Sudanese use traditional medicine alongside or instead of biomedical care. Health professionals must engage respectfully with traditional healing practices while ensuring patient safety.</li><li><strong>Religious beliefs:</strong> Christianity and Islam are the major religions in South Sudan, and religious beliefs significantly influence attitudes toward health interventions such as blood transfusion, contraception, and end-of-life care.</li></ul><h3>Navigating Cultural-Ethical Tensions</h3><p>When cultural practices conflict with bioethical principles, health professionals must navigate these tensions with sensitivity and respect. The key is to engage in respectful dialogue, seek to understand the cultural context, and find solutions that honour both cultural values and ethical principles. Imposing Western bioethical frameworks without cultural sensitivity is both ethically problematic and practically counterproductive in the South Sudan context.</p>',
        4);
    }

    // =========================================================================
    // TOPIC 2 — Patient Rights and Informed Consent
    // =========================================================================
    private function seedTopic2(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Patient Rights and Informed Consent',
            'Understanding patient rights, the legal and ethical requirements for informed consent, and their application in South Sudan health settings.',
            2
        );

        $this->makeSub($topic, 'Patient Rights in South Sudan',
            '<h3>The Foundation of Patient Rights</h3><p>Patient rights are the entitlements that individuals have as recipients of health care. They are grounded in fundamental human rights principles — particularly the right to health, the right to dignity, and the right to non-discrimination — and are given specific content in health care contexts through legislation, professional codes of conduct, and institutional policies.</p><h3>Core Patient Rights</h3><p>Core patient rights that health professionals in South Sudan must uphold include:</p><ul><li><strong>Right to access health care:</strong> Every person has the right to access essential health services without discrimination based on gender, ethnicity, religion, or ability to pay.</li><li><strong>Right to information:</strong> Patients have the right to receive clear, accurate information about their health condition, treatment options, and prognosis in a language they understand.</li><li><strong>Right to informed consent:</strong> Patients have the right to make informed decisions about their health care, including the right to refuse treatment.</li><li><strong>Right to confidentiality:</strong> Patients have the right to have their health information kept confidential.</li><li><strong>Right to dignity:</strong> Patients have the right to be treated with respect and dignity at all times.</li><li><strong>Right to complain:</strong> Patients have the right to complain about the quality of care they receive and to have their complaints addressed.</li></ul><p>In South Sudan, patient rights are often not well understood by either health workers or patients. Health professionals have a responsibility to educate patients about their rights and to create health facility environments where rights are respected in practice.</p>',
        1);

        $this->makeSub($topic, 'Informed Consent: Principles and Process',
            '<h3>What is Informed Consent?</h3><p>Informed consent is the process by which a health professional provides a patient with sufficient information about a proposed intervention to enable the patient to make a voluntary, informed decision about whether to proceed. Informed consent is both an ethical requirement (respecting patient autonomy) and a legal requirement in most jurisdictions.</p><h3>Elements of Valid Informed Consent</h3><p>For consent to be valid, it must meet three criteria:</p><ul><li><strong>Information:</strong> The patient must receive adequate information about the proposed intervention, including its purpose, nature, expected benefits, potential risks and side effects, available alternatives, and consequences of refusing.</li><li><strong>Comprehension:</strong> The patient must understand the information provided. This requires that information is communicated in a language and at a level the patient can understand, and that the health worker checks for understanding.</li><li><strong>Voluntariness:</strong> The patient must make the decision freely, without coercion, manipulation, or undue influence from health workers, family members, or others.</li></ul><h3>Informed Consent in the South Sudan Context</h3><p>Obtaining valid informed consent in South Sudan presents specific challenges including: language barriers (patients may not speak the language used by health workers); low literacy rates (written consent forms may not be appropriate); cultural norms around decision-making (family members may expect to make decisions on behalf of patients); and power imbalances between health workers and patients. Health professionals must adapt their consent processes to address these challenges while upholding the ethical principles underlying informed consent.</p>',
        2);

        $this->makeSub($topic, 'Consent in Special Circumstances',
            '<h3>Consent for Children and Adolescents</h3><p>Children below the age of majority (18 years in South Sudan) generally require parental or guardian consent for health interventions. However, the concept of "Gillick competence" (or "mature minor" doctrine) recognises that some adolescents have sufficient maturity and understanding to consent to certain health interventions independently. This is particularly relevant for adolescent reproductive health services, where requiring parental consent may deter adolescents from seeking care.</p><h3>Consent for Adults Lacking Capacity</h3><p>Adults who lack decision-making capacity (due to unconsciousness, severe mental illness, or cognitive impairment) cannot provide informed consent. In these situations, health professionals must act in the patient\'s best interests, consulting family members or legal guardians where possible. Emergency situations where a patient is unconscious and immediate treatment is needed to save life are an exception — treatment may proceed without consent under the doctrine of necessity.</p><h3>Consent for HIV Testing and Sensitive Health Services</h3><p>Certain health services — particularly HIV testing, mental health treatment, and reproductive health services — require special attention to consent due to the potential for stigma and discrimination. In South Sudan, provider-initiated HIV testing and counselling (PITC) is recommended, but patients must be informed of the test and given the opportunity to opt out. Ensuring that consent processes for sensitive services are genuinely voluntary and free from coercion is a critical ethical obligation for health professionals.</p>',
        3);

        $this->makeSub($topic, 'Confidentiality and Disclosure',
            '<h3>The Duty of Confidentiality</h3><p>Confidentiality is one of the most fundamental ethical obligations in health care. Health professionals who receive information from patients in the course of their professional relationship have a duty to keep that information confidential. Breaching confidentiality without justification is both an ethical violation and potentially a legal offence.</p><h3>Exceptions to Confidentiality</h3><p>The duty of confidentiality is not absolute. There are circumstances where disclosure of patient information without consent may be ethically and legally justified:</p><ul><li><strong>Public health reporting:</strong> Notifiable diseases (e.g., cholera, Ebola, measles) must be reported to public health authorities even without patient consent.</li><li><strong>Serious risk of harm to others:</strong> If a patient poses a serious, credible risk of harm to an identifiable third party, disclosure to protect that person may be justified.</li><li><strong>Court orders:</strong> Health professionals may be required by law to disclose patient information in legal proceedings.</li><li><strong>Patient consent:</strong> Patients may consent to disclosure of their information to family members, employers, or other parties.</li></ul><h3>Confidentiality in the South Sudan Context</h3><p>Maintaining confidentiality in South Sudan\'s health settings is challenging due to: small community sizes where patients may be known to health workers; limited private consultation spaces in health facilities; cultural norms around sharing health information within families; and the stigma associated with certain conditions (HIV, mental illness, tuberculosis). Health professionals must be proactive in creating conditions that protect patient confidentiality, including private consultation spaces, clear policies on information sharing, and staff training on confidentiality obligations.</p>',
        4);
    }

    // =========================================================================
    // TOPIC 3 — Research Ethics and Institutional Review
    // =========================================================================
    private function seedTopic3(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Research Ethics and Institutional Review',
            'Ethical principles governing health research, the role of institutional review boards, and research ethics requirements in South Sudan.',
            3
        );

        $this->makeSub($topic, 'Principles of Research Ethics',
            '<h3>The Belmont Report Principles</h3><p>The Belmont Report (1979) established three foundational principles for ethical research involving human subjects that remain the cornerstone of research ethics globally:</p><ul><li><strong>Respect for persons:</strong> Research participants must be treated as autonomous agents capable of making their own decisions. Those with diminished autonomy (children, prisoners, cognitively impaired individuals) are entitled to additional protections.</li><li><strong>Beneficence:</strong> Researchers must maximise benefits and minimise harms to research participants and society. This requires careful risk-benefit analysis before and during research.</li><li><strong>Justice:</strong> The benefits and burdens of research must be distributed fairly. Vulnerable populations should not bear a disproportionate burden of research risks while more advantaged populations receive the benefits.</li></ul><h3>The Declaration of Helsinki</h3><p>The Declaration of Helsinki, adopted by the World Medical Association, provides ethical principles for medical research involving human subjects. It emphasises that the wellbeing of individual research participants must take precedence over the interests of science and society. Key provisions include: the requirement for independent ethics review; the requirement for informed consent; special protections for vulnerable populations; and requirements for post-trial access to beneficial interventions. The Declaration of Helsinki is the primary international standard for research ethics in South Sudan.</p>',
        1);

        $this->makeSub($topic, 'Institutional Review Boards and Ethics Committees',
            '<h3>The Role of Ethics Review</h3><p>Institutional Review Boards (IRBs) or Research Ethics Committees (RECs) are independent bodies that review research proposals involving human subjects to ensure they meet ethical standards. Ethics review protects research participants from harm, ensures research is conducted with integrity, and builds public trust in health research. In South Sudan, the National Health Research Authority (NHRA) oversees health research ethics, and all health research involving human subjects must receive ethics approval before commencing.</p><h3>The Ethics Review Process</h3><p>The ethics review process typically involves:</p><ul><li><strong>Protocol submission:</strong> The researcher submits a detailed research protocol including study design, participant selection, consent procedures, data management plan, and risk-benefit analysis.</li><li><strong>Initial review:</strong> The IRB/REC reviews the protocol against ethical standards, identifying any concerns or required modifications.</li><li><strong>Researcher response:</strong> The researcher responds to IRB/REC queries and makes required modifications.</li><li><strong>Approval:</strong> The IRB/REC grants approval, typically for a defined period with requirements for progress reporting.</li><li><strong>Continuing review:</strong> Ongoing monitoring of approved research to ensure continued compliance with ethical standards.</li></ul><p>Researchers in South Sudan must obtain ethics approval from both the NHRA and, for internationally funded research, the ethics committee of the funding institution. Understanding the ethics review process and preparing high-quality ethics submissions is an essential competency for health researchers in South Sudan.</p>',
        2);

        $this->makeSub($topic, 'Informed Consent in Research',
            '<h3>Research Consent vs. Clinical Consent</h3><p>Informed consent in research has additional requirements compared to clinical consent because research involves risks that may not benefit the individual participant directly. Research participants must understand that they are participating in research (not receiving standard clinical care), that participation is voluntary, and that they can withdraw at any time without penalty.</p><h3>Elements of Research Informed Consent</h3><p>A valid research informed consent process must cover:</p><ul><li>The purpose of the research and why the participant is being invited</li><li>What participation involves (procedures, time commitment, data collection)</li><li>Potential risks and discomforts</li><li>Potential benefits to the participant and to society</li><li>Alternatives to participation</li><li>How confidentiality will be protected</li><li>Compensation for participation (if any)</li><li>Contact information for questions about the research and about participant rights</li><li>The voluntary nature of participation and the right to withdraw</li></ul><h3>Consent Challenges in South Sudan Research</h3><p>Obtaining valid informed consent for health research in South Sudan faces challenges including: low literacy rates requiring oral consent processes; language barriers requiring translation of consent materials; community consent norms where community leaders must approve research before individuals can participate; and power imbalances between researchers and participants. Researchers must develop culturally appropriate consent processes that genuinely respect participant autonomy while meeting international ethical standards.</p>',
        3);

        $this->makeSub($topic, 'Research Ethics in Vulnerable Populations',
            '<h3>Who are Vulnerable Research Populations?</h3><p>Vulnerable populations in research are groups that may be at increased risk of harm or exploitation due to diminished autonomy, power imbalances, or social disadvantage. In South Sudan, key vulnerable populations in health research include: children and adolescents; pregnant women; prisoners and detainees; internally displaced persons (IDPs) and refugees; people living with HIV; people with mental illness or cognitive impairment; and communities affected by conflict.</p><h3>Additional Protections for Vulnerable Populations</h3><p>Research involving vulnerable populations requires additional ethical safeguards:</p><ul><li><strong>Justification:</strong> Research involving vulnerable populations must be justified — it should either directly benefit the population or address questions that cannot be answered using less vulnerable populations.</li><li><strong>Enhanced consent procedures:</strong> Additional steps to ensure consent is genuinely informed and voluntary, including independent consent monitors and extended consent processes.</li><li><strong>Community engagement:</strong> Engaging community leaders and representatives in research design and oversight.</li><li><strong>Benefit sharing:</strong> Ensuring that research benefits are shared with the communities that participated in the research.</li><li><strong>Post-trial access:</strong> Ensuring that participants have access to beneficial interventions identified through the research.</li></ul><p>In South Sudan, where much of the population could be considered vulnerable due to conflict, displacement, and poverty, researchers must apply particularly rigorous ethical standards and engage deeply with communities throughout the research process.</p>',
        4);
    }

    // =========================================================================
    // TOPIC 4 — Data Privacy and Protection Principles
    // =========================================================================
    private function seedTopic4(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Data Privacy and Protection Principles',
            'Core principles of data privacy and protection as applied to health data, including technical and organisational safeguards.',
            4
        );

        $this->makeSub($topic, 'Foundations of Data Privacy',
            '<h3>What is Data Privacy?</h3><p>Data privacy (also called information privacy) refers to the right of individuals to control how their personal information is collected, used, and shared. In health care, data privacy is particularly important because health information is among the most sensitive personal data — it can affect employment, insurance, relationships, and social standing, and its disclosure can cause significant harm.</p><h3>Key Data Privacy Principles</h3><p>International data privacy frameworks, including the GDPR (General Data Protection Regulation) and the OECD Privacy Guidelines, establish core principles that apply to health data:</p><ul><li><strong>Lawfulness, fairness, and transparency:</strong> Data must be processed lawfully, fairly, and transparently.</li><li><strong>Purpose limitation:</strong> Data must be collected for specified, explicit, and legitimate purposes and not processed in ways incompatible with those purposes.</li><li><strong>Data minimisation:</strong> Only data that is necessary for the stated purpose should be collected.</li><li><strong>Accuracy:</strong> Data must be accurate and kept up to date.</li><li><strong>Storage limitation:</strong> Data should not be kept longer than necessary for the stated purpose.</li><li><strong>Integrity and confidentiality:</strong> Data must be processed securely, protecting against unauthorised access, loss, or destruction.</li><li><strong>Accountability:</strong> Data controllers are responsible for demonstrating compliance with these principles.</li></ul>',
        1);

        $this->makeSub($topic, 'Health Data Classification and Sensitivity',
            '<h3>Categories of Health Data</h3><p>Not all health data carries the same privacy risk. Understanding the sensitivity of different categories of health data helps health professionals apply appropriate protection measures. Categories of health data include:</p><ul><li><strong>Routine clinical data:</strong> Basic health information such as diagnoses, medications, and treatment history. Sensitive but routinely shared among treating clinicians.</li><li><strong>Highly sensitive health data:</strong> Information about HIV status, mental health conditions, substance use, sexual and reproductive health, and genetic information. Requires additional protection due to high stigma and discrimination risk.</li><li><strong>Aggregate/anonymised data:</strong> Statistical data with no identifying information. Lower privacy risk but must be genuinely anonymised to prevent re-identification.</li><li><strong>Research data:</strong> Data collected for research purposes, subject to ethics approval and data use agreements.</li></ul><h3>De-identification and Anonymisation</h3><p>De-identification involves removing or masking information that could identify an individual from a dataset. True anonymisation means the data cannot be re-identified even with additional information. In practice, achieving true anonymisation is difficult — even datasets with names removed can sometimes be re-identified by combining multiple data points. Health professionals must understand the limitations of de-identification and apply appropriate safeguards when sharing health data.</p>',
        2);

        $this->makeSub($topic, 'Technical Safeguards for Health Data Protection',
            '<h3>Encryption</h3><p>Encryption converts data into a coded format that can only be read by authorised parties with the correct decryption key. Health data should be encrypted both in transit (when transmitted over networks) and at rest (when stored on servers or devices). Transport Layer Security (TLS/HTTPS) protects data in transit; full disk encryption and database encryption protect data at rest. In South Sudan, where health data is increasingly stored on mobile devices and transmitted over mobile networks, encryption is a critical safeguard.</p><h3>Access Controls</h3><p>Access controls ensure that only authorised users can access health data, and that each user can only access the data they need for their work. Key access control measures include:</p><ul><li><strong>Authentication:</strong> Verifying the identity of users through passwords, PINs, biometrics, or multi-factor authentication.</li><li><strong>Authorisation:</strong> Defining what data and functions each authenticated user can access (role-based access control).</li><li><strong>Audit logs:</strong> Recording who accessed what data and when, enabling detection of unauthorised access.</li></ul><h3>Data Backup and Recovery</h3><p>Regular data backups protect against data loss due to hardware failure, ransomware, or accidental deletion. Backups should be stored in a separate, secure location (ideally off-site or in the cloud) and tested regularly to ensure they can be restored. In South Sudan, where power outages and hardware failures are common, robust backup procedures are essential for protecting health data.</p>',
        3);

        $this->makeSub($topic, 'Organisational Safeguards and Privacy Culture',
            '<h3>Organisational Measures for Data Protection</h3><p>Technical safeguards alone are insufficient for protecting health data — organisational measures are equally important. Key organisational safeguards include:</p><ul><li><strong>Data protection policies:</strong> Written policies defining how health data is collected, stored, used, shared, and disposed of.</li><li><strong>Staff training:</strong> Regular training for all staff on data privacy obligations and procedures.</li><li><strong>Data protection officer:</strong> A designated individual responsible for overseeing data protection compliance.</li><li><strong>Privacy impact assessments:</strong> Systematic assessments of the privacy risks of new data processing activities before they commence.</li><li><strong>Data breach response plan:</strong> A documented plan for responding to data breaches, including notification procedures.</li><li><strong>Third-party management:</strong> Ensuring that third parties (vendors, partners) who process health data on behalf of the organisation meet required data protection standards.</li></ul><h3>Building a Privacy Culture</h3><p>A privacy culture is one where all staff understand the importance of data privacy, take personal responsibility for protecting patient data, and feel empowered to raise concerns about privacy risks. Building a privacy culture requires leadership commitment, visible role modelling, regular training, and clear consequences for privacy breaches. In South Sudan, where awareness of data privacy is generally low, building a privacy culture requires sustained investment in education and awareness-raising.</p>',
        4);
    }

    // =========================================================================
    // TOPIC 5 — Legal Frameworks for Health Data in South Sudan
    // =========================================================================
    private function seedTopic5(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Legal Frameworks for Health Data in South Sudan',
            'Understanding the legal and regulatory environment governing health data privacy and protection in South Sudan and internationally.',
            5
        );

        $this->makeSub($topic, 'South Sudan Legal Framework for Health Data',
            '<h3>The Legal Landscape</h3><p>South Sudan\'s legal framework for health data privacy is still developing. The country does not yet have a comprehensive data protection law, but several existing laws and regulations have implications for health data management:</p><ul><li><strong>The Transitional Constitution of South Sudan:</strong> Guarantees the right to privacy and the right to health, providing a constitutional foundation for health data protection.</li><li><strong>The Health Act:</strong> Governs the organisation and delivery of health services, including provisions on patient confidentiality.</li><li><strong>The NGO Act:</strong> Regulates the activities of NGOs, including requirements for data management and reporting.</li><li><strong>Professional codes of conduct:</strong> The codes of conduct of health professional associations (medical, nursing, pharmacy) include confidentiality obligations.</li></ul><h3>The Need for Comprehensive Data Protection Legislation</h3><p>South Sudan needs comprehensive data protection legislation to provide a clear legal framework for health data management. Such legislation should address: the rights of data subjects (patients); the obligations of data controllers (health facilities, government, NGOs); requirements for data security; mechanisms for enforcement and redress; and special protections for sensitive health data. Health professionals have an important role in advocating for the development of such legislation.</p>',
        1);

        $this->makeSub($topic, 'International Data Protection Standards',
            '<h3>GDPR and Its Global Influence</h3><p>The European Union\'s General Data Protection Regulation (GDPR), which came into force in 2018, is the most comprehensive data protection law in the world and has had significant global influence. While GDPR does not directly apply in South Sudan, it provides a model for data protection legislation and its principles are increasingly adopted as international best practice. Key GDPR provisions relevant to health data include: the requirement for a lawful basis for processing personal data; special protections for sensitive data (including health data); data subject rights (access, rectification, erasure, portability); requirements for data protection by design and by default; and mandatory breach notification.</p><h3>African Data Protection Frameworks</h3><p>Several African countries have enacted data protection laws that provide models for South Sudan. The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) provides a continental framework. Countries such as Kenya (Data Protection Act 2019), Uganda (Data Protection and Privacy Act 2019), and Rwanda (Law on the Protection of Personal Data 2021) have enacted comprehensive data protection laws that are relevant to South Sudan\'s legislative development. Health professionals in South Sudan should be aware of these regional developments and advocate for South Sudan to develop comparable legislation.</p>',
        2);

        $this->makeSub($topic, 'Health Data in Research and Public Health Law',
            '<h3>Legal Basis for Health Research Data Use</h3><p>Health research requires access to patient data, which must be balanced against patients\' privacy rights. The legal basis for using patient data in research typically includes: explicit patient consent; ethics committee approval; public interest (for research that cannot be conducted with consent); and statutory authority (for public health surveillance and disease notification).</p><h3>Notifiable Disease Reporting</h3><p>South Sudan\'s public health legislation requires health facilities to report certain notifiable diseases to public health authorities. This mandatory reporting overrides the normal duty of confidentiality in the public interest. Notifiable diseases in South Sudan include cholera, Ebola, measles, meningitis, and other epidemic-prone diseases. Health professionals must understand their legal obligations for disease notification and report promptly to enable rapid public health response.</p><h3>Cross-Border Data Sharing</h3><p>Health research in South Sudan often involves international collaborations that require sharing health data across borders. Cross-border data sharing raises additional legal and ethical issues including: which country\'s laws apply; whether the receiving country provides adequate data protection; and whether patients have consented to international data transfer. Health professionals involved in international research collaborations must ensure that cross-border data sharing complies with applicable laws and ethical standards.</p>',
        3);

        $this->makeSub($topic, 'Enforcement, Remedies, and Accountability',
            '<h3>Enforcement of Data Protection Obligations</h3><p>Data protection obligations are only meaningful if they are enforced. Enforcement mechanisms for health data protection in South Sudan include: professional disciplinary proceedings against health workers who breach confidentiality; civil liability for damages caused by data breaches; criminal prosecution for serious data protection offences; and regulatory action by health sector oversight bodies.</p><h3>Patient Remedies for Data Protection Breaches</h3><p>Patients whose health data has been misused or disclosed without authorisation have several potential remedies:</p><ul><li><strong>Complaint to the health facility:</strong> Most health facilities have complaint mechanisms that patients can use to report data protection concerns.</li><li><strong>Complaint to professional regulatory bodies:</strong> Patients can complain to the relevant professional regulatory body (e.g., Medical Council, Nursing Council) about health workers who breach confidentiality.</li><li><strong>Civil litigation:</strong> Patients may be able to sue for damages if they can demonstrate harm resulting from a data protection breach.</li><li><strong>Complaint to the Ministry of Health:</strong> The Ministry of Health has oversight responsibility for health sector compliance with applicable laws and regulations.</li></ul><h3>Building Accountability Systems</h3><p>Effective accountability for health data protection requires: clear policies and standards; regular monitoring and audit; transparent reporting of data breaches; meaningful consequences for non-compliance; and accessible complaint mechanisms for patients. Health leaders have a responsibility to build these accountability systems within their organisations and to advocate for stronger national accountability frameworks.</p>',
        4);
    }

    // =========================================================================
    // TOPIC 6 — Ethical Decision-Making in Clinical Practice
    // =========================================================================
    private function seedTopic6(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Ethical Decision-Making in Clinical Practice',
            'Frameworks and tools for navigating ethical dilemmas in clinical practice, including resource allocation, end-of-life care, and dual loyalty.',
            6
        );

        $this->makeSub($topic, 'Ethical Decision-Making Frameworks',
            '<h3>Approaching Ethical Dilemmas</h3><p>An ethical dilemma arises when two or more ethical principles or values conflict, and there is no obviously right answer. Health professionals face ethical dilemmas regularly — from decisions about resource allocation to questions about truth-telling, confidentiality, and end-of-life care. Having a structured approach to ethical decision-making helps health professionals navigate these dilemmas systematically and justify their decisions.</p><h3>A Practical Ethical Decision-Making Framework</h3><p>A practical framework for ethical decision-making in clinical practice involves the following steps:</p><ul><li><strong>Identify the ethical issue:</strong> What is the ethical problem? Which ethical principles or values are in conflict?</li><li><strong>Gather relevant information:</strong> What are the clinical facts? What are the patient\'s values and preferences? What are the relevant legal and professional obligations?</li><li><strong>Identify the options:</strong> What are the possible courses of action?</li><li><strong>Analyse the options:</strong> Apply ethical principles (autonomy, beneficence, non-maleficence, justice) and ethical theories to evaluate each option.</li><li><strong>Make a decision:</strong> Choose the option that best balances the relevant ethical considerations.</li><li><strong>Implement and review:</strong> Implement the decision and reflect on the outcome to inform future ethical reasoning.</li></ul><p>In South Sudan, ethical decision-making is complicated by resource constraints, cultural factors, and the challenging operating environment. Health professionals must develop the resilience and ethical reasoning skills to navigate these challenges while maintaining their professional integrity.</p>',
        1);

        $this->makeSub($topic, 'Resource Allocation Ethics',
            '<h3>The Ethics of Scarce Resource Allocation</h3><p>In South Sudan\'s resource-constrained health system, health professionals regularly face decisions about how to allocate scarce resources — medicines, equipment, hospital beds, specialist time — among patients who all need them. These allocation decisions have profound ethical implications and must be guided by clear ethical principles.</p><h3>Principles for Fair Resource Allocation</h3><p>Key principles for ethical resource allocation in health care include:</p><ul><li><strong>Medical need:</strong> Resources should be allocated based on clinical need — those who need care most urgently should receive priority.</li><li><strong>Effectiveness:</strong> Resources should be allocated to interventions that are most likely to benefit patients.</li><li><strong>Equity:</strong> Allocation decisions should not discriminate based on gender, ethnicity, religion, social status, or ability to pay.</li><li><strong>Efficiency:</strong> Resources should be used in ways that maximise health benefits for the population.</li><li><strong>Transparency:</strong> Allocation criteria should be explicit, publicly known, and consistently applied.</li></ul><h3>Triage in Emergency Settings</h3><p>Triage is the process of sorting patients according to the urgency of their need for treatment. In emergency settings — including the humanitarian emergencies that are common in South Sudan — triage is an essential tool for allocating scarce emergency care resources. Ethical triage requires: clear, evidence-based triage criteria; consistent application of criteria; transparency about the triage process; and mechanisms for review and appeal.</p>',
        2);

        $this->makeSub($topic, 'End-of-Life Ethics',
            '<h3>Ethical Issues in End-of-Life Care</h3><p>End-of-life care raises profound ethical questions about the goals of medicine, the limits of treatment, and the rights of patients and families. Key ethical issues in end-of-life care include:</p><ul><li><strong>Withholding and withdrawing treatment:</strong> When is it ethically appropriate to withhold or withdraw life-sustaining treatment? The ethical consensus is that there is no moral difference between withholding and withdrawing treatment, and that both are permissible when treatment is futile or when the patient has refused it.</li><li><strong>Palliative care and pain management:</strong> Patients have a right to adequate pain management and palliative care at the end of life. The principle of double effect holds that it is ethically permissible to administer pain medication that may hasten death as a side effect, provided the intention is to relieve suffering.</li><li><strong>Advance directives:</strong> Documents in which patients specify their wishes for end-of-life care in advance, while they still have decision-making capacity.</li></ul><h3>End-of-Life Care in the South Sudan Context</h3><p>End-of-life care in South Sudan is shaped by cultural and religious beliefs about death and dying, limited palliative care services, and the high burden of conflict-related injuries and deaths. Health professionals must engage sensitively with patients and families about end-of-life decisions, respecting cultural and religious values while upholding ethical principles and professional obligations.</p>',
        3);

        $this->makeSub($topic, 'Dual Loyalty and Professional Integrity',
            '<h3>What is Dual Loyalty?</h3><p>Dual loyalty refers to situations where health professionals face conflicting obligations to their patients and to a third party — such as an employer, government, military, or donor. Dual loyalty is a significant ethical challenge in South Sudan, where health professionals may work for government, military, NGOs, or international organisations with interests that may not always align with patient welfare.</p><h3>Examples of Dual Loyalty in South Sudan</h3><p>Examples of dual loyalty situations in South Sudan include:</p><ul><li>A health worker employed by the military who is asked to provide health information about patients to military commanders</li><li>An NGO health worker whose organisation\'s donor requires reporting on patient data that could identify individuals</li><li>A government health worker who is pressured to falsify health data to meet reporting targets</li><li>A health worker who is asked to deny care to members of a particular ethnic group</li></ul><h3>Navigating Dual Loyalty</h3><p>The primary ethical obligation of health professionals is to their patients. When employer or institutional demands conflict with patient welfare, health professionals must prioritise patient interests. Strategies for navigating dual loyalty include: seeking guidance from professional associations and ethics committees; documenting concerns in writing; escalating concerns through appropriate channels; and, in extreme cases, refusing to comply with unethical instructions. Professional associations and international bodies such as the World Medical Association provide guidance on navigating dual loyalty situations.</p>',
        4);
    }

    // =========================================================================
    // TOPIC 7 — Whistleblowing, Accountability and Governance
    // =========================================================================
    private function seedTopic7(Course $course): void
    {
        $topic = $this->makeTopic($course,
            'Whistleblowing, Accountability and Governance',
            'Understanding whistleblowing obligations, accountability mechanisms, and governance frameworks for ethical practice in health organisations.',
            7
        );

        $this->makeSub($topic, 'Whistleblowing in Health Organisations',
            '<h3>What is Whistleblowing?</h3><p>Whistleblowing is the act of reporting wrongdoing, misconduct, or unethical behaviour within an organisation to an internal or external authority. In health care, whistleblowing may involve reporting: patient safety incidents; fraud or financial misconduct; abuse or mistreatment of patients; violations of professional standards; or breaches of data privacy. Whistleblowing is an important accountability mechanism that protects patients and the public from harm.</p><h3>The Ethical Obligation to Report</h3><p>Health professionals have an ethical and, in many cases, legal obligation to report serious wrongdoing that poses a risk to patient safety or public health. This obligation derives from the duty of beneficence (acting in patients\' best interests) and the duty of justice (ensuring fair treatment for all patients). Failing to report known wrongdoing makes health professionals complicit in the harm caused.</p><h3>Barriers to Whistleblowing in South Sudan</h3><p>Despite the ethical obligation to report, whistleblowing is difficult in practice, particularly in South Sudan where:</p><ul><li>Fear of retaliation (job loss, harassment, social ostracism) is a significant deterrent</li><li>Loyalty to colleagues and institutions may override concerns about wrongdoing</li><li>Weak legal protections for whistleblowers leave reporters vulnerable</li><li>Limited independent oversight bodies reduce confidence that reports will be acted upon</li><li>Cultural norms may discourage public criticism of authority figures</li></ul><p>Addressing these barriers requires: legal protections for whistleblowers; confidential reporting mechanisms; independent oversight bodies; and a culture that values accountability over loyalty to individuals or institutions.</p>',
        1);

        $this->makeSub($topic, 'Accountability Mechanisms in Health Systems',
            '<h3>Types of Accountability in Health Systems</h3><p>Accountability in health systems refers to the obligation of health actors to answer for their actions and to face consequences for poor performance or misconduct. There are several types of accountability relevant to health ethics:</p><ul><li><strong>Professional accountability:</strong> Health professionals are accountable to their professional regulatory bodies for compliance with professional standards and codes of conduct.</li><li><strong>Legal accountability:</strong> Health professionals and organisations are accountable under civil and criminal law for negligence, fraud, and other legal violations.</li><li><strong>Administrative accountability:</strong> Health workers are accountable to their employers for compliance with organisational policies and procedures.</li><li><strong>Social accountability:</strong> Health systems are accountable to the communities they serve for the quality, equity, and responsiveness of health services.</li></ul><h3>Accountability Mechanisms in South Sudan</h3><p>Accountability mechanisms in South Sudan\'s health sector include: the Medical Council of South Sudan (professional regulation for doctors); the South Sudan Nurses and Midwives Council; the Ministry of Health\'s inspection and oversight functions; the National Audit Chamber; parliamentary oversight; civil society monitoring; and community feedback mechanisms. Strengthening these accountability mechanisms is essential for improving the ethical quality of health care in South Sudan.</p>',
        2);

        $this->makeSub($topic, 'Ethics Committees and Governance Structures',
            '<h3>The Role of Ethics Committees</h3><p>Ethics committees are bodies that provide guidance on ethical issues arising in clinical practice, research, and health policy. They play an important role in supporting health professionals to navigate complex ethical dilemmas and in developing institutional ethical standards. Types of ethics committees relevant to South Sudan include:</p><ul><li><strong>Clinical ethics committees:</strong> Provide consultation and guidance on ethical issues arising in patient care, such as end-of-life decisions, resource allocation, and consent disputes.</li><li><strong>Research ethics committees:</strong> Review research proposals involving human subjects to ensure they meet ethical standards (see Topic 3).</li><li><strong>Organisational ethics committees:</strong> Address ethical issues at the organisational level, such as conflicts of interest, resource allocation policies, and staff welfare.</li></ul><h3>Establishing Ethics Governance in South Sudan Health Organisations</h3><p>Health organisations in South Sudan can strengthen ethics governance by: establishing clinical ethics committees with clear terms of reference; developing and disseminating codes of conduct for all staff; creating confidential reporting mechanisms for ethical concerns; providing regular ethics training for staff; and integrating ethics considerations into organisational decision-making processes. Leadership commitment to ethical governance is the most important factor in creating a culture of ethical practice.</p>',
        3);

        $this->makeSub($topic, 'Promoting Ethical Culture in Health Organisations',
            '<h3>What is an Ethical Organisational Culture?</h3><p>An ethical organisational culture is one where ethical values are embedded in the organisation\'s mission, policies, and day-to-day practices; where staff feel empowered to raise ethical concerns without fear of retaliation; where ethical behaviour is recognised and rewarded; and where ethical failures are addressed promptly and transparently. Building an ethical culture is a long-term process that requires sustained leadership commitment and investment.</p><h3>Strategies for Building Ethical Culture</h3><p>Practical strategies for building ethical culture in South Sudan health organisations include:</p><ul><li><strong>Leadership modelling:</strong> Senior leaders must visibly model ethical behaviour in their own conduct and decision-making.</li><li><strong>Ethics training:</strong> Regular, practical ethics training for all staff, using case studies relevant to the South Sudan context.</li><li><strong>Clear policies:</strong> Written policies on key ethical issues (confidentiality, consent, conflict of interest, whistleblowing) that are communicated to all staff.</li><li><strong>Safe reporting mechanisms:</strong> Confidential channels for staff to report ethical concerns without fear of retaliation.</li><li><strong>Recognition and reward:</strong> Recognising and rewarding ethical behaviour, not just technical performance.</li><li><strong>Accountability:</strong> Consistent, fair consequences for ethical violations, applied at all levels of the organisation.</li></ul><p>In South Sudan, building ethical culture in health organisations is both a moral imperative and a practical necessity for improving health service quality and patient trust. Health professionals at all levels have a role to play in promoting ethical practice within their organisations and communities.</p>',
        4);
    }

    // =========================================================================
    // EXAM QUESTIONS (35 total — A=9, B=9, C=9, D=8)
    // =========================================================================
    private function seedQuestions(Course $course): void
    {
        $questions = [
            // Q1 — A
            ['question' => 'Which of the four bioethical principles requires health professionals to act in the patient\'s best interests and promote their wellbeing?',
             'a' => 'Beneficence',
             'b' => 'Autonomy',
             'c' => 'Justice',
             'd' => 'Non-maleficence',
             'answer' => 'A',
             'explanation' => 'Beneficence is the obligation to act in the patient\'s best interests and promote their wellbeing, one of the four principles of bioethics by Beauchamp and Childress.'],

            // Q2 — B
            ['question' => 'What are the three foundational principles of the Belmont Report for research ethics?',
             'a' => 'Autonomy, Beneficence, and Non-maleficence',
             'b' => 'Respect for persons, Beneficence, and Justice',
             'c' => 'Informed consent, Confidentiality, and Equity',
             'd' => 'Transparency, Accountability, and Fairness',
             'answer' => 'B',
             'explanation' => 'The Belmont Report (1979) established three foundational principles: Respect for persons (autonomy), Beneficence (maximise benefits, minimise harms), and Justice (fair distribution of research burdens and benefits).'],

            // Q3 — C
            ['question' => 'What are the three criteria for valid informed consent?',
             'a' => 'Signature, Witness, and Documentation',
             'b' => 'Age, Capacity, and Literacy',
             'c' => 'Information, Comprehension, and Voluntariness',
             'd' => 'Diagnosis, Treatment, and Prognosis',
             'answer' => 'C',
             'explanation' => 'Valid informed consent requires: Information (adequate disclosure), Comprehension (patient understands), and Voluntariness (decision is free from coercion).'],

            // Q4 — D
            ['question' => 'Which ethical theory holds that actions should be judged by whether they conform to moral rules or duties, regardless of consequences?',
             'a' => 'Consequentialism',
             'b' => 'Virtue ethics',
             'c' => 'Care ethics',
             'd' => 'Deontology',
             'answer' => 'D',
             'explanation' => 'Deontology judges actions by whether they conform to moral rules or duties (e.g., truth-telling, respect for persons), regardless of their consequences.'],

            // Q5 — A
            ['question' => 'What is the primary international standard for research ethics involving human subjects?',
             'a' => 'The Declaration of Helsinki',
             'b' => 'The Belmont Report',
             'c' => 'The Nuremberg Code',
             'd' => 'The GDPR',
             'answer' => 'A',
             'explanation' => 'The Declaration of Helsinki, adopted by the World Medical Association, is the primary international standard for medical research ethics involving human subjects.'],

            // Q6 — B
            ['question' => 'What is the GDPR principle of "data minimisation"?',
             'a' => 'Reducing the number of staff who can access health data',
             'b' => 'Collecting only data that is necessary for the stated purpose',
             'c' => 'Compressing health data files to reduce storage costs',
             'd' => 'Limiting the retention period for health data',
             'answer' => 'B',
             'explanation' => 'Data minimisation requires that only data necessary for the specified, explicit, and legitimate purpose is collected, reducing privacy risks.'],

            // Q7 — C
            ['question' => 'Which circumstance justifies disclosing patient information without consent in South Sudan?',
             'a' => 'A family member requests the patient\'s diagnosis',
             'b' => 'An employer asks for the patient\'s medical history',
             'c' => 'Mandatory reporting of a notifiable disease to public health authorities',
             'd' => 'A journalist is writing a story about health conditions in the area',
             'answer' => 'C',
             'explanation' => 'Mandatory reporting of notifiable diseases (e.g., cholera, Ebola) to public health authorities is a legally justified exception to the duty of confidentiality in the public interest.'],

            // Q8 — D
            ['question' => 'What is "dual loyalty" in health ethics?',
             'a' => 'A health worker\'s obligation to both their patient and their professional association',
             'b' => 'The requirement to obtain consent from both the patient and their family',
             'c' => 'A health worker\'s obligation to both clinical care and research',
             'd' => 'Conflicting obligations between patient welfare and the interests of an employer or third party',
             'answer' => 'D',
             'explanation' => 'Dual loyalty refers to situations where health professionals face conflicting obligations to their patients and to a third party such as an employer, government, or military.'],

            // Q9 — A
            ['question' => 'What is the "principle of double effect" in end-of-life ethics?',
             'a' => 'It is ethically permissible to administer pain medication that may hasten death as a side effect, provided the intention is to relieve suffering',
             'b' => 'Both withholding and withdrawing treatment are equally impermissible',
             'c' => 'Patients must consent twice before life-sustaining treatment is withdrawn',
             'd' => 'End-of-life decisions require approval from both the patient and their family',
             'answer' => 'A',
             'explanation' => 'The principle of double effect holds that an action with both good and harmful effects is permissible if the intention is the good effect (pain relief), not the harmful one (hastened death).'],

            // Q10 — B
            ['question' => 'Which body oversees health research ethics in South Sudan?',
             'a' => 'The South Sudan Medical Council',
             'b' => 'The National Health Research Authority (NHRA)',
             'c' => 'The Ministry of Justice',
             'd' => 'The South Sudan NGO Forum',
             'answer' => 'B',
             'explanation' => 'The National Health Research Authority (NHRA) oversees health research ethics in South Sudan, and all health research involving human subjects must receive NHRA ethics approval.'],

            // Q11 — C
            ['question' => 'What is the concept of "Gillick competence" relevant to in health ethics?',
             'a' => 'The capacity of elderly patients to make end-of-life decisions',
             'b' => 'The authority of family members to consent on behalf of unconscious patients',
             'c' => 'The ability of adolescents to consent to certain health interventions independently',
             'd' => 'The competence of health workers to perform complex procedures',
             'answer' => 'C',
             'explanation' => 'Gillick competence (or "mature minor" doctrine) recognises that some adolescents have sufficient maturity and understanding to consent to certain health interventions independently.'],

            // Q12 — D
            ['question' => 'Which data protection principle requires that health data is not kept longer than necessary for the stated purpose?',
             'a' => 'Data minimisation',
             'b' => 'Purpose limitation',
             'c' => 'Accuracy',
             'd' => 'Storage limitation',
             'answer' => 'D',
             'explanation' => 'Storage limitation requires that personal data is not kept longer than necessary for the specified purpose, after which it should be deleted or anonymised.'],

            // Q13 — A
            ['question' => 'What is the primary ethical obligation of health professionals when facing dual loyalty conflicts?',
             'a' => 'To prioritise patient welfare over employer or institutional demands',
             'b' => 'To follow employer instructions regardless of patient impact',
             'c' => 'To seek guidance from the donor funding the health programme',
             'd' => 'To resign from their position rather than face the conflict',
             'answer' => 'A',
             'explanation' => 'The primary ethical obligation of health professionals is to their patients. When employer demands conflict with patient welfare, patient interests must be prioritised.'],

            // Q14 — B
            ['question' => 'What is the purpose of a Research Ethics Committee (REC)?',
             'a' => 'To fund health research in South Sudan',
             'b' => 'To review research proposals to ensure they meet ethical standards and protect participants',
             'c' => 'To publish research findings in academic journals',
             'd' => 'To train researchers in data collection methods',
             'answer' => 'B',
             'explanation' => 'A Research Ethics Committee reviews research proposals involving human subjects to ensure they meet ethical standards, protecting participants from harm and ensuring research integrity.'],

            // Q15 — C
            ['question' => 'Which ethical principle is most directly relevant to triage decisions in emergency health settings?',
             'a' => 'Autonomy',
             'b' => 'Non-maleficence',
             'c' => 'Justice',
             'd' => 'Beneficence',
             'answer' => 'C',
             'explanation' => 'Justice — the fair distribution of health benefits and burdens — is most directly relevant to triage, which involves allocating scarce emergency care resources equitably based on clinical need.'],

            // Q16 — D
            ['question' => 'What is Transport Layer Security (TLS) used for in health data protection?',
             'a' => 'Encrypting health data stored on facility servers',
             'b' => 'Managing user access permissions in health information systems',
             'c' => 'Backing up health data to a secure off-site location',
             'd' => 'Encrypting health data in transit over the internet (HTTPS)',
             'answer' => 'D',
             'explanation' => 'TLS is the protocol used to encrypt data in transit over the internet. Health information systems should use HTTPS (which uses TLS) for all web-based access to protect data in transit.'],

            // Q17 — A
            ['question' => 'What is the primary barrier to whistleblowing in South Sudan health organisations?',
             'a' => 'Fear of retaliation including job loss, harassment, and social ostracism',
             'b' => 'Lack of awareness of wrongdoing among health workers',
             'c' => 'Excessive bureaucracy in reporting procedures',
             'd' => 'Insufficient training in whistleblowing procedures',
             'answer' => 'A',
             'explanation' => 'Fear of retaliation — including job loss, harassment, and social ostracism — is the primary barrier to whistleblowing in South Sudan, compounded by weak legal protections for whistleblowers.'],

            // Q18 — B
            ['question' => 'Which African country\'s data protection law, enacted in 2019, provides a model for South Sudan?',
             'a' => 'Nigeria',
             'b' => 'Kenya',
             'c' => 'Ethiopia',
             'd' => 'Tanzania',
             'answer' => 'B',
             'explanation' => 'Kenya\'s Data Protection Act 2019 is one of the most comprehensive data protection laws in Africa and provides a relevant model for South Sudan\'s legislative development.'],

            // Q19 — C
            ['question' => 'What is the "doctrine of necessity" in health ethics?',
             'a' => 'The obligation to provide care to all patients regardless of ability to pay',
             'b' => 'The requirement to obtain consent before any medical procedure',
             'c' => 'The justification for treating an unconscious patient without consent in a life-threatening emergency',
             'd' => 'The principle that health resources must be allocated based on medical need',
             'answer' => 'C',
             'explanation' => 'The doctrine of necessity justifies treating an unconscious patient without consent in a life-threatening emergency, where immediate treatment is needed to save life and consent cannot be obtained.'],

            // Q20 — D
            ['question' => 'What is role-based access control (RBAC) in health data security?',
             'a' => 'A system for encrypting health data based on its sensitivity level',
             'b' => 'A process for auditing who has accessed patient records',
             'c' => 'A framework for training health workers on data privacy',
             'd' => 'A system that assigns data access permissions based on a user\'s role in the organisation',
             'answer' => 'D',
             'explanation' => 'RBAC assigns data access permissions based on a user\'s role (e.g., nurse, doctor, administrator), ensuring each user can only access the data and functions required for their work.'],

            // Q21 — A
            ['question' => 'What is the primary purpose of a clinical ethics committee?',
             'a' => 'To provide consultation and guidance on ethical issues arising in patient care',
             'b' => 'To review research proposals for ethics approval',
             'c' => 'To investigate complaints about health worker misconduct',
             'd' => 'To develop national health policy guidelines',
             'answer' => 'A',
             'explanation' => 'Clinical ethics committees provide consultation and guidance on ethical issues arising in patient care, such as end-of-life decisions, resource allocation, and consent disputes.'],

            // Q22 — B
            ['question' => 'Which collectivist cultural norm in South Sudan most directly affects the application of the autonomy principle?',
             'a' => 'The use of traditional medicine alongside biomedical care',
             'b' => 'Family and community involvement in health decision-making',
             'c' => 'Religious beliefs about the causes of illness',
             'd' => 'Traditional gender roles in health-seeking behaviour',
             'answer' => 'B',
             'explanation' => 'In many South Sudanese cultures, health decisions are made collectively by families and communities, which must be balanced against the bioethical principle of individual patient autonomy.'],

            // Q23 — C
            ['question' => 'What is the purpose of a privacy impact assessment?',
             'a' => 'To audit existing health data systems for security vulnerabilities',
             'b' => 'To train staff on data privacy obligations',
             'c' => 'To systematically assess the privacy risks of new data processing activities before they commence',
             'd' => 'To investigate data breaches after they occur',
             'answer' => 'C',
             'explanation' => 'A privacy impact assessment systematically evaluates the privacy risks of a new data processing activity before it begins, enabling risk mitigation before harm occurs.'],

            // Q24 — D
            ['question' => 'What is the Malabo Convention in the context of African data protection?',
             'a' => 'A bilateral data sharing agreement between South Sudan and Kenya',
             'b' => 'A WHO framework for health data governance in Africa',
             'c' => 'A regional health research ethics standard for East Africa',
             'd' => 'The African Union Convention on Cyber Security and Personal Data Protection',
             'answer' => 'D',
             'explanation' => 'The Malabo Convention is the African Union Convention on Cyber Security and Personal Data Protection, providing a continental framework for data protection legislation.'],

            // Q25 — A
            ['question' => 'What is the ethical obligation of health professionals regarding research participants who wish to withdraw from a study?',
             'a' => 'Participants must be allowed to withdraw at any time without penalty or loss of benefits',
             'b' => 'Participants may only withdraw if they provide a valid medical reason',
             'c' => 'Participants must complete the study if they have already signed the consent form',
             'd' => 'Withdrawal is only permitted during the first week of the study',
             'answer' => 'A',
             'explanation' => 'A fundamental principle of research ethics is that participation is voluntary and participants may withdraw at any time without penalty or loss of any benefits to which they are entitled.'],

            // Q26 — B
            ['question' => 'Which type of accountability holds health professionals responsible to their professional regulatory bodies?',
             'a' => 'Legal accountability',
             'b' => 'Professional accountability',
             'c' => 'Administrative accountability',
             'd' => 'Social accountability',
             'answer' => 'B',
             'explanation' => 'Professional accountability holds health professionals responsible to their professional regulatory bodies (e.g., Medical Council, Nursing Council) for compliance with professional standards and codes of conduct.'],

            // Q27 — C
            ['question' => 'What is the primary purpose of audit logs in health information systems?',
             'a' => 'To back up health data to a secure location',
             'b' => 'To encrypt health data stored in databases',
             'c' => 'To record who accessed what data and when, enabling detection of unauthorised access',
             'd' => 'To validate data entry for accuracy and completeness',
             'answer' => 'C',
             'explanation' => 'Audit logs record all data access events (who, what, when), enabling detection of unauthorised access and providing an accountability trail for data security investigations.'],

            // Q28 — D
            ['question' => 'What is the ethical principle of "non-maleficence" captured in?',
             'a' => 'The Declaration of Helsinki',
             'b' => 'The Belmont Report',
             'c' => 'The GDPR',
             'd' => 'The ancient medical maxim "primum non nocere" (first, do no harm)',
             'answer' => 'D',
             'explanation' => 'Non-maleficence — the obligation to avoid causing harm — is captured in the ancient medical maxim "primum non nocere" (first, do no harm), one of the oldest principles in medical ethics.'],

            // Q29 — A
            ['question' => 'What additional ethical requirement applies to research involving vulnerable populations in South Sudan?',
             'a' => 'Research must either directly benefit the population or address questions that cannot be answered using less vulnerable populations',
             'b' => 'Research must be conducted only by international researchers with external ethics approval',
             'c' => 'Research must be approved by the President of South Sudan',
             'd' => 'Research must be published in an international journal before implementation',
             'answer' => 'A',
             'explanation' => 'Research involving vulnerable populations requires justification — it should directly benefit the population or address questions that cannot be answered using less vulnerable groups.'],

            // Q30 — B
            ['question' => 'What is the purpose of a data breach response plan?',
             'a' => 'To prevent data breaches through technical safeguards',
             'b' => 'To provide a documented procedure for responding to data breaches including notification',
             'c' => 'To train staff on data privacy obligations',
             'd' => 'To assess the privacy risks of new data processing activities',
             'answer' => 'B',
             'explanation' => 'A data breach response plan provides documented procedures for detecting, containing, and responding to data breaches, including notification of affected individuals and regulatory authorities.'],

            // Q31 — C
            ['question' => 'Which virtue is most directly relevant to the obligation of health professionals to tell patients the truth about their diagnosis?',
             'a' => 'Compassion',
             'b' => 'Prudence',
             'c' => 'Honesty',
             'd' => 'Justice',
             'answer' => 'C',
             'explanation' => 'Honesty is the virtue most directly relevant to truth-telling in health care — the obligation to provide patients with accurate information about their health condition and treatment options.'],

            // Q32 — D
            ['question' => 'What is the primary purpose of community consent in health research in South Sudan?',
             'a' => 'To replace individual informed consent for all research participants',
             'b' => 'To satisfy donor requirements for community engagement',
             'c' => 'To reduce the time required for the ethics review process',
             'd' => 'To obtain approval from community leaders before approaching individuals for research participation',
             'answer' => 'D',
             'explanation' => 'Community consent involves obtaining approval from community leaders before approaching individuals for research participation, respecting collectivist decision-making norms while not replacing individual informed consent.'],

            // Q33 — A
            ['question' => 'What is the most important factor in building an ethical organisational culture in a South Sudan health organisation?',
             'a' => 'Leadership commitment and visible modelling of ethical behaviour',
             'b' => 'Implementing the most advanced data security technology',
             'c' => 'Hiring staff with formal ethics qualifications',
             'd' => 'Obtaining international accreditation for the health facility',
             'answer' => 'A',
             'explanation' => 'Leadership commitment and visible modelling of ethical behaviour is the most important factor in building an ethical culture — staff take their cues from how leaders behave.'],

            // Q34 — B
            ['question' => 'What is the purpose of the "purpose limitation" principle in data protection?',
             'a' => 'To limit the number of staff who can access health data',
             'b' => 'To ensure data is collected for specified purposes and not used in incompatible ways',
             'c' => 'To restrict the retention period for health data',
             'd' => 'To limit the geographic area where health data can be stored',
             'answer' => 'B',
             'explanation' => 'Purpose limitation requires that data is collected for specified, explicit, and legitimate purposes and not processed in ways incompatible with those original purposes.'],

            // Q35 — C
            ['question' => 'Which South Sudan constitutional provision provides the foundation for health data protection?',
             'a' => 'The right to education',
             'b' => 'The right to freedom of expression',
             'c' => 'The right to privacy and the right to health',
             'd' => 'The right to property',
             'answer' => 'C',
             'explanation' => 'The Transitional Constitution of South Sudan guarantees both the right to privacy and the right to health, providing the constitutional foundation for health data protection legislation.'],
        ];

        foreach ($questions as $i => $q) {
            $this->makeQuestion($course, $q, $i + 1);
        }
    }

    // =========================================================================
    // DOWNLOADS
    // =========================================================================
    private function seedDownloads(Course $course): void
    {
        $this->makeDownload(
            $course,
            'Ethics Guidelines Reference',
            'ethics-guidelines-reference.pdf',
            'application/pdf',
            1835008  // ~1.75 MB
        );

        $this->makeDownload(
            $course,
            'Data Protection Policy Template',
            'data-protection-policy-template.docx',
            'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
            307200   // ~300 KB
        );
    }
}
