Skip to content

Access Control

Last 1 Enterprises LLC / LastVet Safeguard category: Technical HIPAA Security Rule citation: 45 CFR §164.312(a)(1) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.

Document metadata

Field Value
Policy owner TODO (Ryan)
Version 0.1-scaffold
Effective date TODO (Ryan)
Review cadence Annual (TODO: Ryan confirm)
Approver TODO (Ryan)
Last reviewed 2026-08-26 (scaffold only)

1. Purpose

Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to authorized persons or software.

2. Scope

LastVet API, Postgres, MinIO, edge, admin paths.

3. Policy statements

  1. Unique user identification, emergency access, automatic logoff, encryption and decryption (as applicable) shall be implemented.
  2. Application authentication shall use established session/JWT patterns; provider and veteran flows separated.
  3. Database connections shall use lastvet_app with RLS request context for clinical tables.
  4. Emergency access (break-glass) shall be documented and audited. TODO (Ryan): define break-glass for Postgres owner role.

4. Roles and responsibilities

Role Responsibility
Security Officer (Ryan) TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2)
Workforce members TODO (Ryan): acknowledge policy when hired / annually
Contractors / BAs TODO (Ryan): flow-down via BAA and agreements

5. LastVet-specific context (from existing docs)

POSTURE.md §7: consent engine, JWT/session auth, RLS. Deliberate app.bypass_rls for multi-veteran provider reads. last1.id OIDC for provider portal (auth.last1.id issuer).

7. Ryan TODO (substantive content deferred)

  • Session timeout values for provider portal.
  • Break-glass procedure for DB owner access.
  • Unique ID mapping for workforce vs service accounts.