Device and Media Controls¶
Last 1 Enterprises LLC / LastVet Safeguard category: Physical HIPAA Security Rule citation: 45 CFR §164.310(d)(1) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.
Document metadata¶
| Field | Value |
|---|---|
| Policy owner | TODO (Ryan) |
| Version | 0.1-scaffold |
| Effective date | TODO (Ryan) |
| Review cadence | Annual (TODO: Ryan confirm) |
| Approver | TODO (Ryan) |
| Last reviewed | 2026-08-26 (scaffold only) |
1. Purpose¶
Govern receipt, movement, removal, disposal, and reuse of hardware and electronic media containing ePHI.
2. Scope¶
R940 disks, NAS, backup media, decommissioned AWS volumes, portable drives.
3. Policy statements¶
- Disposal, media re-use, accountability, data backup and storage procedures shall be documented.
- Media containing ePHI shall be sanitized or destroyed before disposal or re-use.
- Backup media on WD My Cloud / R730xd shall be encrypted and access-controlled [Depends on 1a §4 TODO 2].
4. Roles and responsibilities¶
| Role | Responsibility |
|---|---|
| Security Officer (Ryan) | TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2) |
| Workforce members | TODO (Ryan): acknowledge policy when hired / annually |
| Contractors / BAs | TODO (Ryan): flow-down via BAA and agreements |
5. LastVet-specific context (from existing docs)¶
ZFS encryption on imaging dataset; Postgres on tank-fast. AWS legacy rollback net should not receive real PHI. R730xd incoming for backup NAS.
6. Related documents¶
../HIPAA_ARCHITECTURE.md— asset inventory and data flows (Bucket 1a)../HIPAA_RISK_ANALYSIS.md— risk register (Bucket 1b)../../security/POSTURE.md— canonical security posture../../lastvet/README-zfs-recovery.md
7. Ryan TODO (substantive content deferred)¶
- Disk decommission / wipe procedure for R940 drives.
- AWS volume retirement checklist (R-011).
- Backup tape/USB policy if ever used.