HIPAA Security Rule policies (Bucket 1c)¶
Last 1 Enterprises LLC / LastVet
Status: Scaffold set (2026-08-26). Not approved for workforce enforcement until Ryan review and signature.
Bucket: 1c policy documents mapped to HIPAA Security Rule standards.
Depends on: ../HIPAA_ARCHITECTURE.md (1a), ../HIPAA_RISK_ANALYSIS.md (1b).
Policy index¶
Administrative safeguards (§164.308) — 9 policies¶
| File | Policy | Citation |
|---|---|---|
| 01-admin-security-management-process.md | Security Management Process | §164.308(a)(1) |
| 02-admin-assigned-security-responsibility.md | Assigned Security Responsibility | §164.308(a)(2) |
| 03-admin-workforce-security.md | Workforce Security | §164.308(a)(3) |
| 04-admin-information-access-management.md | Information Access Management | §164.308(a)(4) |
| 05-admin-security-awareness-and-training.md | Security Awareness and Training | §164.308(a)(5) |
| 06-admin-security-incident-procedures.md | Security Incident Procedures | §164.308(a)(6) |
| 07-admin-contingency-plan.md | Contingency Plan | §164.308(a)(7) |
| 08-admin-evaluation.md | Evaluation | §164.308(a)(8) |
| 09-admin-business-associate-contracts.md | Business Associate Contracts | §164.308(b)(1) |
Physical safeguards (§164.310) — 4 policies¶
| File | Policy | Citation |
|---|---|---|
| 10-physical-facility-access-controls.md | Facility Access Controls | §164.310(a) |
| 11-physical-workstation-use.md | Workstation Use | §164.310(b) |
| 12-physical-workstation-security.md | Workstation Security | §164.310(c) |
| 13-physical-device-and-media-controls.md | Device and Media Controls | §164.310(d)(1) |
Technical safeguards (§164.312) — 5 policies¶
| File | Policy | Citation |
|---|---|---|
| 14-technical-access-control.md | Access Control | §164.312(a)(1) |
| 15-technical-audit-controls.md | Audit Controls | §164.312(b) |
| 16-technical-integrity.md | Integrity | §164.312(c)(1) |
| 17-technical-person-or-entity-authentication.md | Person or Entity Authentication | §164.312(d) |
| 18-technical-transmission-security.md | Transmission Security | §164.312(e)(1) |
Organizational requirements (§164.314) — 2 policies¶
| File | Policy | Citation |
|---|---|---|
| 19-organizational-business-associate-agreements.md | Business Associate Agreements | §164.314(a)(1) |
| 20-organizational-group-health-plan-requirements.md | Group Health Plan Requirements | §164.314(b) |
Scaffold conventions¶
- Metadata placeholders: owner, effective date, approver — Ryan fills before adoption.
- 1a dependency notation:
[Depends on 1a §4 TODO N: …]in policy body; update when architecture TODOs close. - Substantive deferrals: Approval workflows, incident runbooks, training platform, and HR sanctions are flagged TODO (Ryan) in §7 of each policy.
Completeness (scaffold estimate)¶
| Category | Policies | Scaffold completeness |
|---|---|---|
| Administrative | 9 | ~45% (structure + posture cites; procedures TODO) |
| Physical | 4 | ~40% (facility/colocation gaps) |
| Technical | 5 | ~55% (strong POSTURE alignment) |
| Organizational | 2 | ~35% (counsel confirmation needed) |
| Overall 1c | 20 | ~45% |
Do not publish externally or sync to internal-docs wiki without Ryan approval.