Skip to content

Workforce Security

Last 1 Enterprises LLC / LastVet Safeguard category: Administrative HIPAA Security Rule citation: 45 CFR §164.308(a)(3) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.

Document metadata

Field Value
Policy owner TODO (Ryan)
Version 0.1-scaffold
Effective date TODO (Ryan)
Review cadence Annual (TODO: Ryan confirm)
Approver TODO (Ryan)
Last reviewed 2026-08-26 (scaffold only)

1. Purpose

Ensure workforce members with ePHI access are authorized, supervised, and terminated access is revoked promptly.

2. Scope

Employees, contractors, and operators with Tailscale, SSH, BWS, or application admin access to LastVet systems.

3. Policy statements

  1. Workforce access shall follow least privilege aligned with job function.
  2. Authorization and supervision procedures shall be documented before real veteran PHI admission.
  3. Termination procedures shall revoke Tailscale, SSH, BWS, and application credentials within TODO (Ryan): defined SLA.

4. Roles and responsibilities

Role Responsibility
Security Officer (Ryan) TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2)
Workforce members TODO (Ryan): acknowledge policy when hired / annually
Contractors / BAs TODO (Ryan): flow-down via BAA and agreements

5. LastVet-specific context (from existing docs)

Current admin access: Tailscale mesh to R940 VMs; SSH keys for ryan (and Robert device scope [Depends on 1a §4 TODO 1]). BWS project scoping per BITWARDEN docs. No formal HR termination checklist yet.

7. Ryan TODO (substantive content deferred)

  • Define onboarding/offboarding checklist (Tailscale, GitHub, BWS, Grafana).
  • Document Robert and any future workforce roles vs contractor status.
  • Background check policy if required for workforce with ePHI access.