Skip to content

Compliance documentation (docs/compliance/)

Purpose: LastVet / Last 1 Enterprises internal compliance artifacts for HIPAA Security Rule readiness and related attestations (CARIN, insurance warranties, counsel review).

Audience: Ryan, WSGR / privacy counsel, Comp AI evidence packing, future auditors. Not for public wiki sync or external publication without Ryan approval.

Related Muster: hipaa-security-rule-readiness-3-bucket-compliance-work-plan (3-bucket plan).

Organization

Path Bucket Status
HIPAA_ARCHITECTURE.md 1a foundation (asset inventory, ePHI data-flow, network diagram) Scaffold merged (PR #36); Ryan TODOs open
HIPAA_RISK_ANALYSIS.md 1b risk analysis Scaffold merged (PR #38); Ryan TODOs open
HIPAA_POLICIES/ 1c policy set (20 policies) Scaffold merged (PR #39); Ryan TODOs open
HIPAA_COMPLIANCE_TODO.md Cross-bucket TODO index 78 numbered items; incremental fill tracker
CARIN_*.pdf Existing CARIN attestation evidence Signed artifacts (April 2026)

Sequencing

  1. Buckets 1a–1c: Scaffolds merged; Ryan fills TODOs incrementally (HIPAA_COMPLIANCE_TODO.md).
  2. No wiki sync until substantive review pass (post-SBIR).
  3. Buckets 2–3 (BA verification + evidence, technical build): do not start without explicit Ryan approval.

Source rule for 1a

Scaffolding references existing lastvet-gates / last.vet-api security and topology docs. It does not rewrite those companions. Where facts are unclear, HIPAA_ARCHITECTURE.md uses TODO (Ryan) markers.

Primary companions (do not duplicate)