HIPAA compliance TODO tracker¶
Last 1 Enterprises LLC / LastVet Status: Consolidated index of numbered scaffold TODOs (2026-08-26). Purpose: Queryable list for incremental Ryan fills during SBIR crunch and external triggers (BA verification, Corgi renewal, WSGR review, etc.).
Scaffolds merged with open TODOs (PRs #36, #38, #39). Not a compliance attestation.
Do not sync to internal-docs wiki until substantive review pass (post-SBIR).
Buckets 2–3 (verify + evidence, technical build): do not start without explicit Ryan approval.
Summary¶
| Bucket | Document | Section | Count | PR |
|---|---|---|---|---|
| 1a | HIPAA_ARCHITECTURE.md |
§4 | 12 | #36 |
| 1b | HIPAA_RISK_ANALYSIS.md |
§9 | 10 | #38 |
| 1c | HIPAA_POLICIES/ |
§7 per policy | 56 | #39 |
| Total | 78 |
This index lists numbered / §7 bullet items only. Additional inline TODO (Ryan) and [Depends on 1a §4 TODO N] markers remain in the source documents (189+ inline markers total).
Note: 1a-11 (approve 1b+1c kickoff) was satisfied by merge of #38 and #39; keep for audit trail or mark Done when convenient.
Quick index¶
| ID | Bucket | Item (abbrev.) | Status |
|---|---|---|---|
1a-01 |
1a | Confirm ePHI column for every TODO row in §1 (especially lastvet-edge logs, observability Loki, … |
Open |
1a-02 |
1a | Confirm NAS inventory: WD My Cloud model (EX4100?), what datasets are synced, whether backup dumps w… | Open |
1a-03 |
1a | Confirm network gear in service: SonicWall vs Orbi vs Netgate 5200 actual production path; cloudflar… | Open |
1a-04 |
1a | AWS residual risk: Are imaging S3 buckets / RDS empty of any veteran-class data? Keep or terminate B… | Open |
1a-05 |
1a | Imaging cutover truth: Prod/staging IMAGING_STORAGE_MODE; iOS envelope client shipped or not; any … |
Open |
1a-06 |
1a | VA production timeline: Case #00015000 status for when “synthetic only” claim ends (gates real ePHI … | Open |
1a-07 |
1a | Egress inventory: Email, support tools, analytics, Comp AI, status page: which can see ePHI identifi… | Open |
1a-08 |
1a | Colo / Feb 2027 move: Update physical custody narrative (Muster colo BAA question) if still planned. | Open |
1a-09 |
1a | Owner column: Assign operational owners beyond “Ryan / LastVet” where someone else is accountable. | Open |
1a-10 |
1a | WSGR review packet: After TODOs filled, which excerpt of this file + POSTURE.md goes to privacy spec… | Open |
1a-11 |
1a | Approve Bucket 1b + 1c kickoff only after this file’s TODOs are closed or explicitly deferred with d… | Done (superseded) |
1a-12 |
1a | Muster: Ensure hipaa-security-rule-readiness-3-bucket-compliance-work-plan points at `docs/complia… |
Open |
1b-01 |
1b | Reconcile with 1a: When HIPAA_ARCHITECTURE.md §4 TODOs close, update As… |
Open |
1b-02 |
1b | Assign L/I for all risk register rows (§6); recalculate levels after real PHI admission. | Open |
1b-03 |
1b | Complete threat–vulnerability matrix for full vuln catalog (§4). | Open |
1b-04 |
1b | Tailscale ACL documentation — closes V-A-NET-08-01 gap. | Open |
1b-05 |
1b | Provider session / MFA policy — closes V-A-EP-03-01 and R-017 mitigation detail. | Open |
1b-06 |
1b | Backup/DR test evidence — R-005, R-006 treatment rationale. | Open |
1b-07 |
1b | AWS residual verification — R-011 [Depends on 1a §4 TODO 4]. | Open |
1b-08 |
1b | Egress / email template review — R-014 [Depends on 1a §4 TODO 7]. | Open |
1b-09 |
1b | WSGR packet: Excerpt §6–§8 + POSTURE.md for privacy team with provider agreement (align 1a §4 TODO 1… | Open |
1b-10 |
1b | Annual cadence: Set evaluation schedule per §164.308(a)(8) (see 1c 08-evaluation.md). |
Open |
1c-01-01 |
1c | Define sanction policy workflow and documentation storage. | Open |
1c-01-02 |
1c | Define information system activity review checklist (Loki, Postgres, consent_audit_log, UptimeRobot)… | Open |
1c-01-03 |
1c | Link risk register treatment decisions to Muster tracker items. | Open |
1c-02-01 |
1c | Name Security Officer and deputy in metadata. | Open |
1c-02-02 |
1c | Define escalation to counsel for breach / OCR matters. | Open |
1c-03-01 |
1c | Define onboarding/offboarding checklist (Tailscale, GitHub, BWS, Grafana). | Open |
1c-03-02 |
1c | Document Robert and any future workforce roles vs contractor status. | Open |
1c-03-03 |
1c | Background check policy if required for workforce with ePHI access. | Open |
1c-04-01 |
1c | Access request / approval workflow for operators. | Open |
1c-04-02 |
1c | Minimum necessary matrix by role (provider, support, engineering). | Open |
1c-04-03 |
1c | Reconcile with 1a asset owners (§4 TODO 9). | Open |
1c-05-01 |
1c | Define training content aligned with LastVet two-data-plane and consent model. | Open |
1c-05-02 |
1c | Document training records retention. | Open |
1c-05-03 |
1c | Provider-facing security expectations (separate from workforce?) — coordinate with WSGR provider agr… | Open |
1c-06-01 |
1c | Draft incident response playbook referencing observability VM and Tailscale isolation. | Open |
1c-06-02 |
1c | Define breach vs security incident threshold with WSGR. | Open |
1c-06-03 |
1c | Tabletop exercise schedule. | Open |
1c-07-01 |
1c | RTO/RPO for Postgres and imaging. | Open |
1c-07-02 |
1c | Restore drill evidence (Depends on 1a §4 TODO 2 — NAS contents). | Open |
1c-07-03 |
1c | Emergency operations if R940 unavailable. | Open |
1c-08-01 |
1c | Define evaluation calendar and responsible party. | Open |
1c-08-02 |
1c | Comp AI / audit evidence packing workflow. | Open |
1c-08-03 |
1c | Trigger evaluation on VA prod access approval (#00015000). | Open |
1c-09-01 |
1c | BAA inventory table with vendor, status, renewal date. | Open |
1c-09-02 |
1c | Provider BAA template alignment with WSGR draft. | Open |
1c-09-03 |
1c | Confirm whether colo move requires facility BAA (1a §4 TODO 8). | Open |
1c-10-01 |
1c | Facility access log or badge policy if colo. | Open |
1c-10-02 |
1c | Visitor escort procedures. | Open |
1c-10-03 |
1c | iDRAC physical port access controls. | Open |
1c-11-01 |
1c | Screen lock / timeout requirements. | Open |
1c-11-02 |
1c | Prohibition on local PHI storage on operator devices except approved tools. | Open |
1c-11-03 |
1c | Provider workstation guidance in provider agreement. | Open |
1c-12-01 |
1c | Define minimum OS patch cadence for operator machines. | Open |
1c-12-02 |
1c | Lost device procedure. | Open |
1c-13-01 |
1c | Disk decommission / wipe procedure for R940 drives. | Open |
1c-13-02 |
1c | AWS volume retirement checklist (R-011). | Open |
1c-13-03 |
1c | Backup tape/USB policy if ever used. | Open |
1c-14-01 |
1c | Session timeout values for provider portal. | Open |
1c-14-02 |
1c | Break-glass procedure for DB owner access. | Open |
1c-14-03 |
1c | Unique ID mapping for workforce vs service accounts. | Open |
1c-15-01 |
1c | Define audit log review procedure (link to 01-admin-security-management-process). | Open |
1c-15-02 |
1c | Clock sync / NTP standard. | Open |
1c-15-03 |
1c | Alert on audit pipeline failure. | Open |
1c-16-01 |
1c | Checksum or versioning policy for critical documents if not already enforced. | Open |
1c-16-02 |
1c | Integrity monitoring for MinIO objects. | Open |
1c-17-01 |
1c | MFA policy for Tailscale and BWS. | Open |
1c-17-02 |
1c | Provider identity proofing alignment with onboarding. | Open |
1c-17-03 |
1c | Service account rotation schedule. | Open |
1c-18-01 |
1c | Verify MinIO TLS configuration in ops runbook. | Open |
1c-18-02 |
1c | Certificate expiry monitoring ownership. | Open |
1c-18-03 |
1c | Client-side certificate pinning if ever required for mobile. | Open |
1c-19-01 |
1c | Subcontractor flow-down template. | Open |
1c-19-02 |
1c | BAA termination and data return procedure. | Open |
1c-19-03 |
1c | Angel/Neon and other org boundaries — confirm out of LastVet BAA scope. | Open |
1c-20-01 |
1c | Counsel confirmation to file in compliance folder. | Open |
1c-20-02 |
1c | If status changes, add plan documents and certification requirements. | Open |
Detailed entries¶
1a-01¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Confirm ePHI column for every TODO row in §1 (especially
lastvet-edgelogs,observabilityLoki,angel-local,n8n-r940,auth-last1id/sovereign-db-last1id, Mac/agent-01, Robert device).
1a-02¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Confirm NAS inventory: WD My Cloud model (EX4100?), what datasets are synced, whether backup dumps will contain ePHI at first real veteran, R730xd delivery/install plan.
1a-03¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Confirm network gear in service: SonicWall vs Orbi vs Netgate 5200 actual production path; cloudflared still required for which hostnames.
1a-04¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: AWS residual risk: Are imaging S3 buckets / RDS empty of any veteran-class data? Keep or terminate BAA coverage narrative for auditors.
1a-05¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Imaging cutover truth: Prod/staging
IMAGING_STORAGE_MODE; iOS envelope client shipped or not; any remaining S3 presigned clients.
1a-06¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: VA production timeline: Case #00015000 status for when “synthetic only” claim ends (gates real ePHI admission).
1a-07¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Egress inventory: Email, support tools, analytics, Comp AI, status page: which can see ePHI identifiers.
1a-08¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Colo / Feb 2027 move: Update physical custody narrative (Muster colo BAA question) if still planned.
1a-09¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Owner column: Assign operational owners beyond “Ryan / LastVet” where someone else is accountable.
1a-10¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: WSGR review packet: After TODOs filled, which excerpt of this file + POSTURE.md goes to privacy specialists with the provider agreement / BAA draft.
1a-11¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Done (superseded by PR #38/#39 merge)
- Item: Approve Bucket 1b + 1c kickoff only after this file’s TODOs are closed or explicitly deferred with dates.
1a-12¶
- Bucket: 1a
- Source: HIPAA_ARCHITECTURE.md §4
- Merged via: PR #36
- Status: Open
- Item: Muster: Ensure
hipaa-security-rule-readiness-3-bucket-compliance-work-planpoints atdocs/compliance/HIPAA_ARCHITECTURE.md(item may need filing if missing from tracker).
1b-01¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Reconcile with 1a: When
HIPAA_ARCHITECTURE.md§4 TODOs close, update Asset ID ePHI flags, vulnerability rows, and matrix cells marked ○ or "Blocked on 1a".
1b-02¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Assign L/I for all risk register rows (§6); recalculate levels after real PHI admission.
1b-03¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Complete threat–vulnerability matrix for full vuln catalog (§4).
1b-04¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Tailscale ACL documentation — closes V-A-NET-08-01 gap.
1b-05¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Provider session / MFA policy — closes V-A-EP-03-01 and R-017 mitigation detail.
1b-06¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Backup/DR test evidence — R-005, R-006 treatment rationale.
1b-07¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: AWS residual verification — R-011 [Depends on 1a §4 TODO 4].
1b-08¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Egress / email template review — R-014 [Depends on 1a §4 TODO 7].
1b-09¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: WSGR packet: Excerpt §6–§8 + POSTURE.md for privacy team with provider agreement (align 1a §4 TODO 10).
1b-10¶
- Bucket: 1b
- Source: HIPAA_RISK_ANALYSIS.md §9
- Merged via: PR #38
- Status: Open
- Item: Annual cadence: Set evaluation schedule per §164.308(a)(8) (see 1c
08-evaluation.md).
1c-01-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/01-admin-security-management-process.md §7
- Merged via: PR #39
- Status: Open
- Item: Define sanction policy workflow and documentation storage.
1c-01-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/01-admin-security-management-process.md §7
- Merged via: PR #39
- Status: Open
- Item: Define information system activity review checklist (Loki, Postgres, consent_audit_log, UptimeRobot).
1c-01-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/01-admin-security-management-process.md §7
- Merged via: PR #39
- Status: Open
- Item: Link risk register treatment decisions to Muster tracker items.
1c-02-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/02-admin-assigned-security-responsibility.md §7
- Merged via: PR #39
- Status: Open
- Item: Name Security Officer and deputy in metadata.
1c-02-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/02-admin-assigned-security-responsibility.md §7
- Merged via: PR #39
- Status: Open
- Item: Define escalation to counsel for breach / OCR matters.
1c-03-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/03-admin-workforce-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Define onboarding/offboarding checklist (Tailscale, GitHub, BWS, Grafana).
1c-03-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/03-admin-workforce-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Document Robert and any future workforce roles vs contractor status.
1c-03-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/03-admin-workforce-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Background check policy if required for workforce with ePHI access.
1c-04-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/04-admin-information-access-management.md §7
- Merged via: PR #39
- Status: Open
- Item: Access request / approval workflow for operators.
1c-04-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/04-admin-information-access-management.md §7
- Merged via: PR #39
- Status: Open
- Item: Minimum necessary matrix by role (provider, support, engineering).
1c-04-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/04-admin-information-access-management.md §7
- Merged via: PR #39
- Status: Open
- Item: Reconcile with 1a asset owners (§4 TODO 9).
1c-05-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/05-admin-security-awareness-and-training.md §7
- Merged via: PR #39
- Status: Open
- Item: Define training content aligned with LastVet two-data-plane and consent model.
1c-05-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/05-admin-security-awareness-and-training.md §7
- Merged via: PR #39
- Status: Open
- Item: Document training records retention.
1c-05-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/05-admin-security-awareness-and-training.md §7
- Merged via: PR #39
- Status: Open
- Item: Provider-facing security expectations (separate from workforce?) — coordinate with WSGR provider agreement.
1c-06-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/06-admin-security-incident-procedures.md §7
- Merged via: PR #39
- Status: Open
- Item: Draft incident response playbook referencing observability VM and Tailscale isolation.
1c-06-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/06-admin-security-incident-procedures.md §7
- Merged via: PR #39
- Status: Open
- Item: Define breach vs security incident threshold with WSGR.
1c-06-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/06-admin-security-incident-procedures.md §7
- Merged via: PR #39
- Status: Open
- Item: Tabletop exercise schedule.
1c-07-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/07-admin-contingency-plan.md §7
- Merged via: PR #39
- Status: Open
- Item: RTO/RPO for Postgres and imaging.
1c-07-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/07-admin-contingency-plan.md §7
- Merged via: PR #39
- Status: Open
- Item: Restore drill evidence (Depends on 1a §4 TODO 2 — NAS contents).
1c-07-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/07-admin-contingency-plan.md §7
- Merged via: PR #39
- Status: Open
- Item: Emergency operations if R940 unavailable.
1c-08-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/08-admin-evaluation.md §7
- Merged via: PR #39
- Status: Open
- Item: Define evaluation calendar and responsible party.
1c-08-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/08-admin-evaluation.md §7
- Merged via: PR #39
- Status: Open
- Item: Comp AI / audit evidence packing workflow.
1c-08-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/08-admin-evaluation.md §7
- Merged via: PR #39
- Status: Open
- Item: Trigger evaluation on VA prod access approval (#00015000).
1c-09-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/09-admin-business-associate-contracts.md §7
- Merged via: PR #39
- Status: Open
- Item: BAA inventory table with vendor, status, renewal date.
1c-09-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/09-admin-business-associate-contracts.md §7
- Merged via: PR #39
- Status: Open
- Item: Provider BAA template alignment with WSGR draft.
1c-09-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/09-admin-business-associate-contracts.md §7
- Merged via: PR #39
- Status: Open
- Item: Confirm whether colo move requires facility BAA (1a §4 TODO 8).
1c-10-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/10-physical-facility-access-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Facility access log or badge policy if colo.
1c-10-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/10-physical-facility-access-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Visitor escort procedures.
1c-10-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/10-physical-facility-access-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: iDRAC physical port access controls.
1c-11-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/11-physical-workstation-use.md §7
- Merged via: PR #39
- Status: Open
- Item: Screen lock / timeout requirements.
1c-11-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/11-physical-workstation-use.md §7
- Merged via: PR #39
- Status: Open
- Item: Prohibition on local PHI storage on operator devices except approved tools.
1c-11-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/11-physical-workstation-use.md §7
- Merged via: PR #39
- Status: Open
- Item: Provider workstation guidance in provider agreement.
1c-12-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/12-physical-workstation-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Define minimum OS patch cadence for operator machines.
1c-12-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/12-physical-workstation-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Lost device procedure.
1c-13-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/13-physical-device-and-media-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Disk decommission / wipe procedure for R940 drives.
1c-13-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/13-physical-device-and-media-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: AWS volume retirement checklist (R-011).
1c-13-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/13-physical-device-and-media-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Backup tape/USB policy if ever used.
1c-14-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/14-technical-access-control.md §7
- Merged via: PR #39
- Status: Open
- Item: Session timeout values for provider portal.
1c-14-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/14-technical-access-control.md §7
- Merged via: PR #39
- Status: Open
- Item: Break-glass procedure for DB owner access.
1c-14-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/14-technical-access-control.md §7
- Merged via: PR #39
- Status: Open
- Item: Unique ID mapping for workforce vs service accounts.
1c-15-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/15-technical-audit-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Define audit log review procedure (link to 01-admin-security-management-process).
1c-15-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/15-technical-audit-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Clock sync / NTP standard.
1c-15-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/15-technical-audit-controls.md §7
- Merged via: PR #39
- Status: Open
- Item: Alert on audit pipeline failure.
1c-16-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/16-technical-integrity.md §7
- Merged via: PR #39
- Status: Open
- Item: Checksum or versioning policy for critical documents if not already enforced.
1c-16-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/16-technical-integrity.md §7
- Merged via: PR #39
- Status: Open
- Item: Integrity monitoring for MinIO objects.
1c-17-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/17-technical-person-or-entity-authentication.md §7
- Merged via: PR #39
- Status: Open
- Item: MFA policy for Tailscale and BWS.
1c-17-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/17-technical-person-or-entity-authentication.md §7
- Merged via: PR #39
- Status: Open
- Item: Provider identity proofing alignment with onboarding.
1c-17-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/17-technical-person-or-entity-authentication.md §7
- Merged via: PR #39
- Status: Open
- Item: Service account rotation schedule.
1c-18-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/18-technical-transmission-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Verify MinIO TLS configuration in ops runbook.
1c-18-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/18-technical-transmission-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Certificate expiry monitoring ownership.
1c-18-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/18-technical-transmission-security.md §7
- Merged via: PR #39
- Status: Open
- Item: Client-side certificate pinning if ever required for mobile.
1c-19-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/19-organizational-business-associate-agreements.md §7
- Merged via: PR #39
- Status: Open
- Item: Subcontractor flow-down template.
1c-19-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/19-organizational-business-associate-agreements.md §7
- Merged via: PR #39
- Status: Open
- Item: BAA termination and data return procedure.
1c-19-03¶
- Bucket: 1c
- Source: HIPAA_POLICIES/19-organizational-business-associate-agreements.md §7
- Merged via: PR #39
- Status: Open
- Item: Angel/Neon and other org boundaries — confirm out of LastVet BAA scope.
1c-20-01¶
- Bucket: 1c
- Source: HIPAA_POLICIES/20-organizational-group-health-plan-requirements.md §7
- Merged via: PR #39
- Status: Open
- Item: Counsel confirmation to file in compliance folder.
1c-20-02¶
- Bucket: 1c
- Source: HIPAA_POLICIES/20-organizational-group-health-plan-requirements.md §7
- Merged via: PR #39
- Status: Open
- Item: If status changes, add plan documents and certification requirements.