Skip to content

Security Incident Procedures

Last 1 Enterprises LLC / LastVet Safeguard category: Administrative HIPAA Security Rule citation: 45 CFR §164.308(a)(6) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.

Document metadata

Field Value
Policy owner TODO (Ryan)
Version 0.1-scaffold
Effective date TODO (Ryan)
Review cadence Annual (TODO: Ryan confirm)
Approver TODO (Ryan)
Last reviewed 2026-08-26 (scaffold only)

1. Purpose

Identify, respond to, and mitigate suspected or known security incidents involving ePHI.

2. Scope

All LastVet systems and workforce.

3. Policy statements

  1. Workforce shall report suspected security incidents to the Security Officer immediately.
  2. LastVet shall document incident response phases: detection, containment, eradication, recovery, and notification assessment.
  3. TODO (Ryan): LastVet-specific incident runbook (R940 isolation, log preservation, breach assessment with counsel).
  4. Notification to individuals/HHS/OCR shall follow counsel guidance and applicable breach notification rules.

4. Roles and responsibilities

Role Responsibility
Security Officer (Ryan) TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2)
Workforce members TODO (Ryan): acknowledge policy when hired / annually
Contractors / BAs TODO (Ryan): flow-down via BAA and agreements

5. LastVet-specific context (from existing docs)

Alertmanager/Prometheus rules exist for platform outages (including PostgresDown scoping). No LastVet-specific security incident runbook tied to ePHI breach assessment yet.

7. Ryan TODO (substantive content deferred)

  • Draft incident response playbook referencing observability VM and Tailscale isolation.
  • Define breach vs security incident threshold with WSGR.
  • Tabletop exercise schedule.