Contingency Plan¶
Last 1 Enterprises LLC / LastVet Safeguard category: Administrative HIPAA Security Rule citation: 45 CFR §164.308(a)(7) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.
Document metadata¶
| Field | Value |
|---|---|
| Policy owner | TODO (Ryan) |
| Version | 0.1-scaffold |
| Effective date | TODO (Ryan) |
| Review cadence | Annual (TODO: Ryan confirm) |
| Approver | TODO (Ryan) |
| Last reviewed | 2026-08-26 (scaffold only) |
1. Purpose¶
Establish (and implement as needed) policies for responding to emergencies or other occurrences that damage systems containing ePHI.
2. Scope¶
LastVet production and staging on R940; backup systems (NAS, planned B2).
3. Policy statements¶
- Data backup plan: Document backup scope, frequency, encryption, and retention. Rsync to WD My Cloud today; R730xd and B2 planned.
- Disaster recovery plan: TODO (Ryan): RTO/RPO targets; restore procedures for Postgres, MinIO, ZFS keys.
- Emergency mode operation plan: TODO (Ryan): AWS rollback net is synthetic-only; confirm whether emergency fallback is permitted for real PHI.
- Testing and revision: Backup restore tests on defined cadence.
4. Roles and responsibilities¶
| Role | Responsibility |
|---|---|
| Security Officer (Ryan) | TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2) |
| Workforce members | TODO (Ryan): acknowledge policy when hired / annually |
| Contractors / BAs | TODO (Ryan): flow-down via BAA and agreements |
5. LastVet-specific context (from existing docs)¶
R940_PLATFORM_ARCHITECTURE.md documents backup intent; POSTURE gap register notes offsite B2 and Loki single-VM risk. ZFS imaging key in BWS (README-zfs-recovery.md).
6. Related documents¶
../HIPAA_ARCHITECTURE.md— asset inventory and data flows (Bucket 1a)../HIPAA_RISK_ANALYSIS.md— risk register (Bucket 1b)../../security/POSTURE.md— canonical security posture../../architecture/R940_PLATFORM_ARCHITECTURE.md../../lastvet/README-postgres-recovery.md
7. Ryan TODO (substantive content deferred)¶
- RTO/RPO for Postgres and imaging.
- Restore drill evidence (Depends on 1a §4 TODO 2 — NAS contents).
- Emergency operations if R940 unavailable.