Audit Controls¶
Last 1 Enterprises LLC / LastVet Safeguard category: Technical HIPAA Security Rule citation: 45 CFR §164.312(b) Status: Scaffold (Bucket 1c). Not approved for enforcement until Ryan review.
Document metadata¶
| Field | Value |
|---|---|
| Policy owner | TODO (Ryan) |
| Version | 0.1-scaffold |
| Effective date | TODO (Ryan) |
| Review cadence | Annual (TODO: Ryan confirm) |
| Approver | TODO (Ryan) |
| Last reviewed | 2026-08-26 (scaffold only) |
1. Purpose¶
Implement hardware, software, and procedural mechanisms to record and examine activity in systems that contain or use ePHI.
2. Scope¶
LastVet API, Postgres, Caddy, MinIO (deferred), Loki audit tier.
3. Policy statements¶
- Audit logs shall capture security-relevant events including consent changes and imaging download URL issuance.
consent_audit_logis append-only for defined events.- Platform logs shall use Loki audit retention tier (6yr target) for API, Postgres, and Caddy sources.
- TODO (Ryan): MinIO audit integration; offsite immutable log archive.
4. Roles and responsibilities¶
| Role | Responsibility |
|---|---|
| Security Officer (Ryan) | TODO (Ryan): assign formal Security Rule responsible person per §164.308(a)(2) |
| Workforce members | TODO (Ryan): acknowledge policy when hired / annually |
| Contractors / BAs | TODO (Ryan): flow-down via BAA and agreements |
5. LastVet-specific context (from existing docs)¶
POSTURE.md §5: Loki 3.3.2 on observability VM; Promtail on 11 VMs; audit tier labels. Gap: single VM and no B2 offsite for audit logs.
6. Related documents¶
../HIPAA_ARCHITECTURE.md— asset inventory and data flows (Bucket 1a)../HIPAA_RISK_ANALYSIS.md— risk register (Bucket 1b)../../security/POSTURE.md— canonical security posture../../observability/OBSERVABILITY_STACK.md
7. Ryan TODO (substantive content deferred)¶
- Define audit log review procedure (link to 01-admin-security-management-process).
- Clock sync / NTP standard.
- Alert on audit pipeline failure.