Skip to content

Information Access Management

Last 1 Enterprises LLC / LastVet Safeguard category: Administrative HIPAA Security Rule citation: 45 CFR §164.308(a)(4) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.

Document metadata

Field Value
Policy owner TODO (Ryan)
Version 0.1-scaffold
Effective date TODO (Ryan)
Review cadence Annual (TODO: Ryan confirm)
Approver TODO (Ryan)
Last reviewed 2026-08-26 (scaffold only)

1. Purpose

Authorize access to ePHI based on role, consent, and minimum necessary principles.

2. Scope

LastVet API, database, imaging store, provider portal, and operator tools.

3. Policy statements

  1. Access to veteran ePHI shall require valid consent (or documented exception such as grant-free DD-214 link per product rules).
  2. Provider access shall be gated by the consent engine and category rules (CONSENT_AND_DOCUMENT_CATEGORIES.md).
  3. Database access shall use lastvet_app runtime role without superuser privileges; owner credentials restricted to migration/ops paths.
  4. TODO (Ryan): Document access provisioning workflow for new operators vs providers.

4. Roles and responsibilities

Role Responsibility
Security Officer (Ryan) TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2)
Workforce members TODO (Ryan): acknowledge policy when hired / annually
Contractors / BAs TODO (Ryan): flow-down via BAA and agreements

5. LastVet-specific context (from existing docs)

RLS on four clinical tables with FORCE; thirteen consent-related tables still app-layer only (RLS batch 2 required before real PHI). Provider document RLS context wiring fixed 2026-07-21.

7. Ryan TODO (substantive content deferred)

  • Access request / approval workflow for operators.
  • Minimum necessary matrix by role (provider, support, engineering).
  • Reconcile with 1a asset owners (§4 TODO 9).